CVE-2020-8833
published 2020-04-22CVE-2020-8833: Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If…
PriorityP423medium4.7CVSS 3.1
AVLACHPRLUINSUCHINAN
EPSS
0.34%
26.4th percentile
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apport_project | apport | >= 0 < 2.20.1-0ubuntu2.23 | 2.20.1-0ubuntu2.23 |
| apport_project | apport | >= 0 < 2.20.9-0ubuntu7.14 | 2.20.9-0ubuntu7.14 |
| apport_project | apport | >= 0 < 2.20.11-0ubuntu22 | 2.20.11-0ubuntu22 |
| apport_project | apport | >= 0 < 2.14.1-0ubuntu3.29+esm4 | 2.14.1-0ubuntu3.29+esm4 |
| canonical | apport | >= 2.20.1 < 2.20.1-0ubuntu2.23 | 2.20.1-0ubuntu2.23 |
| canonical | apport | >= 2.20.11 < 2.20.11-0ubuntu8.8 | 2.20.11-0ubuntu8.8 |
| canonical | apport | >= 2.20.9 < 2.20.9-0ubuntu7.14 | 2.20.9-0ubuntu7.14 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w9g5-3qgc-xmgx: Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportuni
ghsa_unreviewed·2022-05-24
CVE-2020-8833 [LOW] CWE-367 GHSA-w9g5-3qgc-xmgx: Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportuni
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
OSV
apport vulnerabilities
osv·2020-06-15·CVSS 5.5
CVE-2020-8831 [MEDIUM] apport vulnerabilities
apport vulnerabilities
USN-4315-1 fixed several vulnerabilities in Apport. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Maximilien Bourgeteau discovered that the Apport lock file was created with
insecure permissions. This could allow a local attacker to escalate their
privileges via a symlink attack. (CVE-2020-8831)
Maximilien Bourgeteau discovered a race condition in Apport when setting
crash report permissions. This could allow a local attacker to read
arbitrary files via a symlink attack. (CVE-2020-8833)
OSV
apport vulnerabilities
osv·2020-04-02·CVSS 5.5
CVE-2020-8831 [MEDIUM] apport vulnerabilities
apport vulnerabilities
Maximilien Bourgeteau discovered that the Apport lock file was created with
insecure permissions. This could allow a local attacker to escalate their
privileges via a symlink attack. (CVE-2020-8831)
Maximilien Bourgeteau discovered a race condition in Apport when setting
crash report permissions. This could allow a local attacker to read
arbitrary files via a symlink attack. (CVE-2020-8833)
OSV
CVE-2020-8833: Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportuni
osv·2020-04-02·CVSS 4.7
CVE-2020-8833 [MEDIUM] CVE-2020-8833: Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportuni
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
Ubuntu
Apport vulnerabilities
vendor_ubuntu·2020-06-15·CVSS 6.5
CVE-2020-8831 [MEDIUM] Apport vulnerabilities
Title: Apport vulnerabilities
Summary: Several security issues were fixed in Apport.
USN-4315-1 fixed several vulnerabilities in Apport. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Maximilien Bourgeteau discovered that the Apport lock file was created with
insecure permissions. This could allow a local attacker to escalate their
privileges via a symlink attack. (CVE-2020-8831)
Maximilien Bourgeteau discovered a race condition in Apport when setting
crash report permissions. This could allow a local attacker to read
arbitrary files via a symlink attack. (CVE-2020-8833)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Apport vulnerabilities
vendor_ubuntu·2020-04-02·CVSS 6.5
CVE-2020-8831 [MEDIUM] Apport vulnerabilities
Title: Apport vulnerabilities
Summary: Several security issues were fixed in Apport.
Maximilien Bourgeteau discovered that the Apport lock file was created with
insecure permissions. This could allow a local attacker to escalate their
privileges via a symlink attack. (CVE-2020-8831)
Maximilien Bourgeteau discovered a race condition in Apport when setting
crash report permissions. This could allow a local attacker to read
arbitrary files via a symlink attack. (CVE-2020-8833)
Instructions: In general, a standard system update will make all the necessary changes.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-04-22
Published