TOCTOU in apport

Vulnerability

CVE-2020-15702 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in the apport package, which is automatically installed on Ubuntu systems to generate crash reports. Affected versions are apport prior to 2.20.1-0ubuntu2.24, 2.20.9 before 2.20.9-0ubuntu7.16, and 2.20.11 before 2.20.11-0ubuntu27.6. The flaw resides in the lack of proper locking when performing operations on a crash file, allowing a race window between a check and a use of that file.[1][2][3]

Exploitation

An attacker must first be able to execute low-privileged code on the target system. The attacker monitors for a process crash handled by apport and races with the crash-handling logic. Upon detecting a crash, the attacker exits their own process and then exploits PID recycling: when a new root-level process (such as a cron job) starts with the same PID as the crashed process, the attacker can replace the crash report file with a symbolic link to an arbitrary file. In the race window, apport follows the link and performs privileged operations (e.g., writing or setting ownership) on the attacker-chosen file. This sequence leverages the inherent race condition due to the absence of proper locking.[1][3]

Impact

Successful exploitation allows the attacker to escalate privileges to root and execute arbitrary code. The attacker can gain complete control over the target system, including reading, modifying, or deleting any file and executing commands with root privileges. Both confidentiality and integrity are compromised, and availability may also be affected.[1][3]

Mitigation

Canonical released fixed versions of apport on 4 August 2020: 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.16, and 2.20.11-0ubuntu27.6. All users should update their apport package to the patched version via the standard Ubuntu package manager (apt update && apt upgrade apport). No known workaround exists; applying the patch is the only mitigation. This vulnerability was reported through the ZDI program (ZDI-20-979) and is listed as a separate CVE from the related issues fixed in the same advisory.[1][2][3]