CVE-2022-28652

What it actually does

The vulnerability permits a malicious configuration file to trigger exponential entity expansion (billion laughs) during XML parsing of ~/.config/apport/settings, exhausting CPU and memory resources and resulting in denial of service.

Why it matters to the business

Systems may become unresponsive due to resource exhaustion, interrupting error reporting and related workflows; the issue affects Ubuntu Linux environments with apport but carries low exploitation likelihood given its age, lack of known campaigns, and minimal EPSS score.

How an attack unfolds

An attacker with local access writes a crafted settings file containing recursive XML entities into a user's apport configuration directory; when apport parses the file during startup or crash handling, the entity expansion consumes system resources until the process or host is disrupted.

How to fix it

Upgrade apport to a patched release that disables or safely limits XML entity expansion during settings parsing; restrict write permissions on user configuration directories to prevent unauthorized file placement; monitor package repositories for updated Ubuntu apport packages.

How to confirm the fix worked

Confirm that apport safely rejects or bounds entity expansion in configuration files without excessive resource usage; test parsing of known malicious settings files in a controlled environment and verify package versions after updates.

Typical attack path

1. Gain local user privileges on a target system
2. Place a malicious XML settings file containing recursive entity definitions at ~/.config/apport/settings
3. Trigger apport execution or system error reporting
4. Cause sustained high CPU and memory consumption leading to denial of service

How to detect it

Inspect system and process logs for sustained high CPU or memory consumption by apport; search user home directories for recently modified apport configuration files; review audit logs for unexpected writes to configuration paths.

• ~/.config/apport/settings
• apport process high memory usage
• XML entity expansion patterns in configuration files

What your security team should do

• Apply available apport updates from distribution repositories as soon as released
• Enforce strict file permissions on ~/.config/apport to block untrusted writes
• Monitor for anomalous resource usage by apport processes
• Review and harden local configuration file handling across Ubuntu deployments