Cloudanix VulnDB

CVE-2020-8831

Medium · 5.5

CVSS

5.5

EPSS

0.7%

Published

Apr 22, 2020

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Ubuntu's crash-reporting tool lets a local user trick it into overwriting important system files, which could let them take control of the machine.

Exploit Available
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Privilege Gain
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits creation of a world-writable lock file owned by root inside /var/lock/apport; when the directory is absent it is created on the fly, enabling an attacker-controlled symlink to redirect the lock file write to an arbitrary target and thereby modify privileged files.

Why it matters to the business

Local attackers can obtain elevated privileges on Ubuntu systems running the vulnerable error-reporting package, risking unauthorized system changes and potential full host compromise.

How an attack unfolds

An attacker first creates a symlink at the expected lock-file path pointing to a sensitive target such as /etc/passwd or a cron file, then invokes apport (directly or via a crash) so that the process follows the link and writes its lock contents into the chosen file, achieving privilege escalation.

How to fix it

Upgrade the apport package to one of the fixed releases 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 or 2.20.11-0ubuntu22; ensure /var/lock/apport is not world-writable after the update.

How to confirm the fix worked

Confirm the installed apport package version matches a listed fixed release and verify that the /var/lock/apport directory is absent or has correct ownership and permissions (root:root 755).

Typical attack path

  1. Create symlink /var/lock/apport -> target file
  2. Trigger apport execution or crash report
  3. Apport follows symlink and writes lock data to target
  4. Leverage modified file for privilege escalation

How to detect it

Search system logs and audit trails for creation of symlinks under /var/lock, unexpected file modifications performed by the apport process, or writes to /var/lock/apport when the directory should not exist.

  • /var/lock/apport
  • apport.*lock
  • symlink.*apport

What your security team should do

  • Apply the apport package upgrade on all affected Ubuntu systems
  • Restrict local user accounts to the minimum necessary privileges
  • Review system logs for unexpected writes or symlink activity under /var/lock

The record

Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for example. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:14.04:LTS apport 0 2.14.1-0ubuntu3.29+esm4
Ubuntu:16.04:LTS apport 0 2.20.1-0ubuntu2.23
Ubuntu:18.04:LTS apport 0 2.20.9-0ubuntu7.14
Ubuntu:20.04:LTS apport 0 2.20.11-0ubuntu22
Ubuntu:Pro:14.04:LTS apport 0 2.14.1-0ubuntu3.29+esm4

Related vulnerabilities