CVE-2021-25682
📋 TL;DR
CVE-2021-25682 is a vulnerability in Apport's get_pid_info() function that improperly parses /proc/pid/status files, potentially allowing local privilege escalation. This affects Ubuntu systems with Apport installed. Attackers could exploit this to gain root privileges from a local user account.
💻 Affected Systems
- Apport
📦 What is this software?
Apport by Canonical
Apport by Canonical
Apport by Canonical
Apport by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root privileges, compromising the entire system and potentially pivoting to other systems.
Likely Case
Local privilege escalation allowing attackers to execute arbitrary code with root permissions.
If Mitigated
Limited impact if proper access controls restrict local user accounts and Apport is disabled or patched.
🎯 Exploit Status
Exploitation requires local access but is relatively straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apport 2.20.11-0ubuntu27.20 and later
Vendor Advisory: https://ubuntu.com/security/notices/USN-4737-1
Restart Required: No
Instructions:
1. Update system: sudo apt update && sudo apt upgrade 2. Specifically update apport: sudo apt install --only-upgrade apport 3. Verify version: dpkg -l apport
🔧 Temporary Workarounds
Disable Apport
linuxTemporarily disable Apport crash reporting service
sudo systemctl stop apport
sudo systemctl disable apport
Remove Apport
linuxCompletely remove Apport package if not needed
sudo apt remove apport
🧯 If You Can't Patch
- Restrict local user access and implement strict access controls
- Monitor for suspicious privilege escalation attempts and Apport process activity
🔍 How to Verify
Check if Vulnerable:
Check Apport version: dpkg -l apport | grep ^iiCheck Version:
dpkg -l apport | grep ^ii | awk '{print $3}'Verify Fix Applied:
Verify installed version is 2.20.11-0ubuntu27.20 or later: dpkg -l apport📡 Detection & Monitoring
Log Indicators:
- Unusual Apport process activity
- Failed privilege escalation attempts in auth logs
- Suspicious /proc file access
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
process_name:"apport" AND (event_type:"privilege_escalation" OR parent_process:"apport")