CVE-2020-8831: apport_project apport

Vulnerability summary

CVE-2020-8831 is a medium (CVSS 6.5) vulnerability in apport_project apport. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-04-2020
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for example. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.

• CWE-379Creation of Temporary File in Directory with Insecure PermissionsThe product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.