CVE-2020-8831
published 2020-04-22CVE-2020-8831: Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this…
PriorityP427medium5.5CVSS 3.1
AVLACLPRLUINSUCNIHAN
EPSS
0.65%
47.1th percentile
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for example. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apport_project | apport | >= 0 < 2.20.1-0ubuntu2.23 | 2.20.1-0ubuntu2.23 |
| apport_project | apport | >= 0 < 2.20.9-0ubuntu7.14 | 2.20.9-0ubuntu7.14 |
| apport_project | apport | >= 0 < 2.20.11-0ubuntu22 | 2.20.11-0ubuntu22 |
| apport_project | apport | >= 0 < 2.14.1-0ubuntu3.29+esm4 | 2.14.1-0ubuntu3.29+esm4 |
| canonical | apport | >= 2.20.1 < 2.20.1-0ubuntu2.23 | 2.20.1-0ubuntu2.23 |
| canonical | apport | >= 2.20.11 < 2.20.11-0ubuntu8.8 | 2.20.11-0ubuntu8.8 |
| canonical | apport | >= 2.20.9 < 2.20.9-0ubuntu7.14 | 2.20.9-0ubuntu7.14 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N
osv5.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-33w2-prhc-2q89: Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory
ghsa_unreviewed·2022-05-24
CVE-2020-8831 [LOW] CWE-59 GHSA-33w2-prhc-2q89: Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for example. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
OSV
apport vulnerabilities
osv·2020-06-15·CVSS 5.5
CVE-2020-8831 [MEDIUM] apport vulnerabilities
apport vulnerabilities
USN-4315-1 fixed several vulnerabilities in Apport. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Maximilien Bourgeteau discovered that the Apport lock file was created with
insecure permissions. This could allow a local attacker to escalate their
privileges via a symlink attack. (CVE-2020-8831)
Maximilien Bourgeteau discovered a race condition in Apport when setting
crash report permissions. This could allow a local attacker to read
arbitrary files via a symlink attack. (CVE-2020-8833)
OSV
CVE-2020-8831: Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory
osv·2020-04-02·CVSS 5.5
CVE-2020-8831 [MEDIUM] CVE-2020-8831: Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for example. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
OSV
apport vulnerabilities
osv·2020-04-02·CVSS 5.5
CVE-2020-8831 [MEDIUM] apport vulnerabilities
apport vulnerabilities
Maximilien Bourgeteau discovered that the Apport lock file was created with
insecure permissions. This could allow a local attacker to escalate their
privileges via a symlink attack. (CVE-2020-8831)
Maximilien Bourgeteau discovered a race condition in Apport when setting
crash report permissions. This could allow a local attacker to read
arbitrary files via a symlink attack. (CVE-2020-8833)
Ubuntu
Apport vulnerabilities
vendor_ubuntu·2020-06-15·CVSS 6.5
CVE-2020-8831 [MEDIUM] Apport vulnerabilities
Title: Apport vulnerabilities
Summary: Several security issues were fixed in Apport.
USN-4315-1 fixed several vulnerabilities in Apport. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Maximilien Bourgeteau discovered that the Apport lock file was created with
insecure permissions. This could allow a local attacker to escalate their
privileges via a symlink attack. (CVE-2020-8831)
Maximilien Bourgeteau discovered a race condition in Apport when setting
crash report permissions. This could allow a local attacker to read
arbitrary files via a symlink attack. (CVE-2020-8833)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Apport vulnerabilities
vendor_ubuntu·2020-04-02·CVSS 6.5
CVE-2020-8831 [MEDIUM] Apport vulnerabilities
Title: Apport vulnerabilities
Summary: Several security issues were fixed in Apport.
Maximilien Bourgeteau discovered that the Apport lock file was created with
insecure permissions. This could allow a local attacker to escalate their
privileges via a symlink attack. (CVE-2020-8831)
Maximilien Bourgeteau discovered a race condition in Apport when setting
crash report permissions. This could allow a local attacker to read
arbitrary files via a symlink attack. (CVE-2020-8833)
Instructions: In general, a standard system update will make all the necessary changes.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-04-22
Published