CVE-2021-32549
📋 TL;DR
This vulnerability in Apport's read_file() function allows local attackers to read arbitrary files by exploiting symbolic links or FIFOs. It affects Ubuntu systems with openjdk-13 package apport hooks installed, potentially exposing sensitive data to other local users.
💻 Affected Systems
- apport
- openjdk-13
📦 What is this software?
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to complete system compromise through exposure of sensitive files like /etc/shadow, SSH keys, or configuration files with credentials.
Likely Case
Unauthorized local users reading sensitive application data, configuration files, or temporary files containing user information.
If Mitigated
Limited impact with proper file permissions and isolation between user accounts, preventing cross-user data exposure.
🎯 Exploit Status
Exploitation requires local user access and ability to create symbolic links or FIFOs in specific directories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: apport 2.20.11-0ubuntu27.20 and later
Vendor Advisory: https://ubuntu.com/security/CVE-2021-32549
Restart Required: No
Instructions:
1. Update apport package: sudo apt update && sudo apt install apport
2. Update openjdk-13 package: sudo apt install openjdk-13-jre
3. Verify updates with: apt list --installed | grep -E 'apport|openjdk-13'
🔧 Temporary Workarounds
Disable apport hooks for openjdk-13
linuxRemove or disable the vulnerable apport hooks for openjdk-13 package
sudo rm /usr/share/apport/package-hooks/source_openjdk-13.py
sudo systemctl disable apport.service
Restrict symbolic link creation
linuxImplement filesystem policies to restrict symbolic link creation in sensitive directories
sudo chmod 1777 /tmp
sudo find /var/crash -type l -delete
🧯 If You Can't Patch
- Implement strict file permissions and user isolation to limit cross-user file access
- Monitor for suspicious symbolic link creation in /var/crash and other apport-related directories
🔍 How to Verify
Check if Vulnerable:
Check apport version: dpkg -l apport | grep ^iiCheck Version:
dpkg -l apportVerify Fix Applied:
Verify apport version is 2.20.11-0ubuntu27.20 or higher: dpkg -l apport📡 Detection & Monitoring
Log Indicators:
- Unusual apport crash report activity
- Multiple symbolic link creations in /var/crash
Network Indicators:
- None - local-only vulnerability
SIEM Query:
process.name="apport" AND file.path="/var/crash/*" AND file.symlink=true