CVE-2022-28658

What it actually does

Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing

Why it matters to the business

Local users may be able to influence process arguments in crash reporting flows, potentially bypassing intended security controls on systems running older kernels; the large number of downstream GitLab dependents increases exposure surface across development pipelines.

How an attack unfolds

An attacker on a local system crafts a filename containing special characters that Apport's parser splits incorrectly on older kernels, causing spoofed arguments to be passed to handlers and enabling unauthorized actions without elevated privileges.

How to fix it

Upgrade gitlab-org/gitlab to commit 67af793e55bd098111d3c3e265cd2c92eb283f1c or later; apply kernel updates where feasible and review argument handling in related components.

How to confirm the fix worked

Confirm the deployed GitLab version includes commit 67af793e55bd098111d3c3e265cd2c92eb283f1c; test argument parsing with crafted filenames on representative older kernels.

Typical attack path

1. Identify a system running an older kernel with Apport enabled
2. Create a maliciously named file or trigger a crash report
3. Exploit the filename splitting flaw to inject spoofed arguments
4. Achieve argument spoofing to alter expected behavior

How to detect it

Search system and application logs for unusual argument patterns or filenames containing delimiters around crash report events; review process execution traces for unexpected argument values.

What your security team should do

• Prioritize upgrade of all GitLab instances to the fixed commit within the next patching cycle
• Monitor for local privilege or argument manipulation attempts in crash reporting paths
• Review dependencies on Apport or similar argument parsers for similar issues