CVE-2021-25684
📋 TL;DR
CVE-2021-25684 is a vulnerability in Ubuntu's Apport crash reporting system where improper handling of FIFO (named pipe) files could allow local attackers to cause denial of service or potentially execute arbitrary code. This affects Ubuntu systems with Apport enabled. The vulnerability stems from improper input validation when opening report files.
💻 Affected Systems
- Ubuntu Apport
📦 What is this software?
Apport by Canonical
Apport by Canonical
Apport by Canonical
Apport by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, arbitrary code execution, or complete system compromise through crafted FIFO files.
Likely Case
Denial of service through system hangs or crashes when Apport processes malicious FIFO files.
If Mitigated
Minimal impact if Apport is disabled or proper file permissions prevent unauthorized FIFO creation.
🎯 Exploit Status
Exploitation requires local access to create FIFO files. Public proof-of-concept demonstrates denial of service. More sophisticated attacks might be possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apport 2.20.11-0ubuntu27.20 for Ubuntu 20.04 LTS, with corresponding fixes for other Ubuntu releases
Vendor Advisory: https://ubuntu.com/security/CVE-2021-25684
Restart Required: No
Instructions:
1. Run 'sudo apt update' 2. Run 'sudo apt upgrade apport' 3. Verify the updated version with 'apt-cache policy apport'
🔧 Temporary Workarounds
Disable Apport
linuxCompletely disable the Apport crash reporting service
sudo systemctl stop apport
sudo systemctl disable apport
sudo sed -i 's/enabled=1/enabled=0/' /etc/default/apport
Restrict FIFO Creation
linuxImplement filesystem controls to prevent unauthorized FIFO creation in sensitive directories
🧯 If You Can't Patch
- Disable Apport service completely using systemctl commands
- Implement strict file permissions and monitoring for FIFO file creation in /var/crash and other Apport directories
🔍 How to Verify
Check if Vulnerable:
Check Apport version with 'apt-cache policy apport' and compare against patched versions for your Ubuntu releaseCheck Version:
apt-cache policy apport | grep InstalledVerify Fix Applied:
Verify Apport version is at least 2.20.11-0ubuntu27.20 for Ubuntu 20.04 LTS, or corresponding fixed version for your release📡 Detection & Monitoring
Log Indicators:
- Apport process hanging or crashing
- Unusual FIFO file creation in /var/crash
- System logs showing Apport service failures
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
process.name:"apport" AND (event.action:"hang" OR event.action:"crash") OR file.path:"/var/crash/*" AND file.type:"fifo"