Apport reads PID files with elevated privileges

Vulnerability

Apport, an automatic crash report tool, reads and writes information on a crashed process to /proc/pid with elevated privileges. The vulnerability lies in the get_pid_info() function in data/apport, which determines the user of the crashed process by reading /proc/pid. An unprivileged user can exploit PID recycling to read information about a privileged running process. Affected versions include those prior to fixes in 2.20.11-0ubuntu16, 2.20.11-0ubuntu8.6, 2.20.9-0ubuntu7.12, 2.20.1-0ubuntu2.22, and 2.14.1-0ubuntu3.29+esm3.

Exploitation

An attacker needs local unprivileged access to the system. By exploiting PID recycling, the attacker can cause Apport to read /proc/pid of a privileged process. The attacker can then obtain the contents of /proc/pid (e.g., maps, environ) which contain ASLR offsets.

Impact

Successful exploitation allows an attacker to obtain ASLR offsets for a privileged process. This information can be used in conjunction with an existing memory corruption vulnerability to bypass ASLR and achieve code execution.

Mitigation

The vulnerability is fixed in Apport versions 2.20.11-0ubuntu16, 2.20.11-0ubuntu8.6, 2.20.9-0ubuntu7.12, 2.20.1-0ubuntu2.22, and 2.14.1-0ubuntu3.29+esm3. Users should update to the patched versions. No workaround is available. The initial fix introduced regressions that were later resolved in the same updates.