CVE-2021-32547

What it actually does

read_file() in apport/hookutils.py follows symbolic links and opens FIFOs, allowing local exposure of arbitrary file contents when invoked by openjdk-lts apport hooks.

Why it matters to the business

Local users on affected Ubuntu systems can read files they should not access, increasing risk of credential or configuration data leakage with moderate urgency given the flaw's age and lack of observed exploitation.

How an attack unfolds

An attacker on the same system creates a symbolic link or FIFO that points to a target file containing private data, then triggers the openjdk-lts apport hook so that read_file() dereferences the link and returns the contents.

How to fix it

Upgrade the apport and openjdk-lts packages to patched versions that replace or guard read_file() against symlink and FIFO traversal; apply all subsequent Ubuntu security updates.

How to confirm the fix worked

Confirm the installed apport package contains the symlink/FIFO hardening fix in hookutils.py and test that read_file() no longer follows links when invoked by the openjdk-lts hook.

Typical attack path

1. Create symlink or FIFO in a location readable by the apport hook process
2. Point the link at a target file containing private data
3. Trigger the openjdk-lts apport hook that calls read_file()
4. Read the returned file contents from hook output or logs

How to detect it

Review system logs for unexpected apport hook executions, unusual symlink creation in crash directories, and any hook output containing paths outside expected package directories.

What your security team should do

• Prioritize patching apport and openjdk-lts on all Ubuntu systems within the next maintenance window
• Audit local user access to /var/crash and apport hook directories
• Monitor for new CVEs in apport hook utilities and subscribe to Ubuntu security notices