Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
References
| Link | Resource |
|---|---|
| https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1862933 | Exploit Third Party Advisory |
| https://usn.ubuntu.com/4315-1/ | Third Party Advisory |
| https://usn.ubuntu.com/4315-2/ | Third Party Advisory |
| https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1862933 | Exploit Third Party Advisory |
| https://usn.ubuntu.com/4315-1/ | Third Party Advisory |
| https://usn.ubuntu.com/4315-2/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 05:39
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 1.9
v3 : 5.6 |
| References | () https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1862933 - Exploit, Third Party Advisory | |
| References | () https://usn.ubuntu.com/4315-1/ - Third Party Advisory | |
| References | () https://usn.ubuntu.com/4315-2/ - Third Party Advisory |
07 Oct 2022, 15:14
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
|
| References | (UBUNTU) https://usn.ubuntu.com/4315-2/ - Third Party Advisory |
Information
Published : 2020-04-22 22:15
Updated : 2024-11-21 05:39
NVD link : CVE-2020-8833
Mitre link : CVE-2020-8833
CVE.ORG link : CVE-2020-8833
JSON object : View
Products Affected
canonical
- ubuntu_linux
apport_project
- apport
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition