CVE-2020-15703

What it actually does

The flaw permits an unprivileged local user to supply an arbitrary writable directory path via the Locale property in an apt transaction, bypassing input validation; combined with a symlink, this causes aptd to attempt file access as root and leak existence information through error messages versus silent success.

Why it matters to the business

Attackers can silently map the presence of sensitive system files, enabling targeted follow-on attacks that increase risk of privilege escalation or data exposure without direct code execution.

How an attack unfolds

An attacker with local unprivileged access crafts a malicious apt transaction that sets the Locale property to a full path under their control containing a symlink; aptd running as root follows the symlink during transaction processing and returns distinguishable error behavior depending on whether the target file exists, allowing the attacker to enumerate any file path on the system.

How to fix it

Upgrade aptdaemon to a version that enforces strict validation on the Locale property and rejects absolute paths or symlinks; until a fixed package is available, restrict unprivileged access to aptd interfaces via AppArmor/SELinux policies or disable the service if not required.

How to confirm the fix worked

Test by attempting a transaction with a Locale value containing a symlink to both existing and non-existing files and confirm that no distinguishable error behavior or root-level file access occurs; review aptd source for input sanitization on Locale and related properties.

Typical attack path

1. Obtain local unprivileged shell access on a system running aptdaemon
2. Create a writable directory and place a symlink pointing to the target file to probe
3. Invoke aptd or an apt client to start a transaction supplying the directory path in the Locale property
4. Observe transaction error output or lack thereof to determine file existence
5. Repeat for multiple paths to build a map of the filesystem

How to detect it

Search aptd or apt transaction logs for Locale property values containing absolute paths or references outside expected locale directories; look for sequences of symlink creation in user-writable areas immediately followed by aptd process activity or error messages indicating file operations as root.

• Locale=/.*/
• aptd.*transaction.*Locale
• symlink.*aptdaemon

What your security team should do

• Prioritize patching aptdaemon as soon as a fixed package is released due to the local information disclosure risk
• Audit systems for aptdaemon usage and apply mandatory access controls to limit its privileges
• Monitor for local users creating symlinks in /tmp or home directories followed by apt transaction activity
• Consider removing aptdaemon from multi-user systems where local enumeration is a concern