Headline
CVE-2020-15702: USN-4449-1: Apport vulnerabilities | Ubuntu security notices | Ubuntu
TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges. Fixed in 2.20.1-0ubuntu2.24, 2.20.9 versions prior to 2.20.9-0ubuntu7.16 and 2.20.11 versions prior to 2.20.11-0ubuntu27.6. Was ZDI-CAN-11234.
4 August 2020
Several security issues were fixed in Apport.
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
Learn more about Ubuntu Pro
Releases
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
Packages
- apport - automatically generate crash reports for debugging
Details
Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that
Apport incorrectly dropped privileges when making certain D-Bus calls. A
local attacker could use this issue to read arbitrary files.
(CVE-2020-11936)
Seong-Joong Kim discovered that Apport incorrectly parsed configuration
files. A local attacker could use this issue to cause Apport to crash,
resulting in a denial of service. (CVE-2020-15701)
Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that
Apport incorrectly implemented certain checks. A local attacker could use
this issue to escalate privileges and run arbitrary code. (CVE-2020-15702)
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
Learn more about Ubuntu Pro
Related notices
- USN-4449-2: apport-noui, apport-kde, apport-valgrind, dh-apport, apport-gtk, python-apport, apport-retrace, apport, python3-problem-report, python-problem-report, python3-apport
Related news
An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.16, 2.20.11-0ubuntu27.6.