Cloudanix VulnDB

CVE-2021-3709

Medium · 5.5

CVSS

5.5

EPSS

0.5%

Published

Oct 1, 2021

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A local user on certain Ubuntu systems could trick the crash reporting tool into revealing private files that should have stayed hidden.

Exploit Available
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The check_attachment_for_errors function in ubuntu.py can be tricked by a maliciously crafted crash report file into reading and exposing arbitrary private files on the system due to insufficient path validation.

Why it matters to the business

Attackers with local access can obtain sensitive user or system data, increasing risk of data leakage, compliance violations, and loss of confidentiality on affected Ubuntu systems.

How an attack unfolds

A local attacker constructs a malicious crash file with crafted attachment paths, triggers apport's error-checking routine, and causes it to read and include private files in the resulting report that can then be accessed or exfiltrated.

How to fix it

Upgrade apport to a fixed version such as 2.14.1-0ubuntu3.29+esm8, 2.20.1-0ubuntu2.30+esm2, 2.20.9-0ubuntu7.26, 2.20.11-0ubuntu27.20, or 2.20.11-0ubuntu65.3 depending on the release in use.

How to confirm the fix worked

Verify the installed apport package version against the fixed releases listed in the advisory and confirm that crafted crash files no longer result in disclosure of files outside the intended attachment directory.

Typical attack path

  1. Obtain local user access on an affected Ubuntu system
  2. Craft a malicious crash file with traversal sequences targeting sensitive paths
  3. Place the file in a location monitored by apport
  4. Trigger the check_attachment_for_errors function
  5. Access the resulting crash report containing exposed private data

How to detect it

Review system logs for apport crash processing events, inspect generated .crash files for unexpected file paths or contents, and search for reports containing data from sensitive locations such as /etc or user home directories.

What your security team should do

  • Prioritize patching apport on all Ubuntu systems to the versions specified in the advisory
  • Review local user permissions and limit ability to generate or submit crash reports where possible
  • Monitor for unusual crash report generation or attachment behavior

The record

Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS apport 0 2.20.9-0ubuntu7.26
Ubuntu:20.04:LTS apport 0 2.20.11-0ubuntu27.20
Ubuntu:Pro:14.04:LTS apport 0 2.14.1-0ubuntu3.29+esm8
Ubuntu:Pro:16.04:LTS apport 0 2.20.1-0ubuntu2.30+esm2

Related vulnerabilities