CVE-2021-32551
📋 TL;DR
This vulnerability in Apport's read_file() function allows local attackers to read arbitrary files by exploiting symbolic links or FIFOs. It affects Ubuntu systems with openjdk-15 package apport hooks enabled, potentially exposing sensitive data to other local users.
💻 Affected Systems
- apport
- openjdk-15
📦 What is this software?
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to complete system compromise through exposure of sensitive files like SSH keys, passwords, or configuration files.
Likely Case
Unauthorized local users reading sensitive application data, configuration files, or user-specific information from other accounts.
If Mitigated
Limited exposure of non-critical files if proper file permissions and access controls are implemented.
🎯 Exploit Status
Exploitation requires local user access and ability to create symbolic links or FIFOs in specific locations
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apport versions with fix for CVE-2021-32551
Vendor Advisory: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
Restart Required: No
Instructions:
1. Update apport package: sudo apt update && sudo apt upgrade apport
2. Verify update: apt-cache policy apport
3. Ensure openjdk-15 is also updated if needed
🔧 Temporary Workarounds
Disable apport crash reporting
linuxTemporarily disable apport service to prevent hook execution
sudo systemctl stop apport
sudo systemctl disable apport
Remove openjdk-15 apport hooks
linuxRemove or disable specific hooks for openjdk-15
sudo rm /usr/share/apport/package-hooks/source_openjdk-15.py
🧯 If You Can't Patch
- Implement strict file permissions and access controls to limit sensitive file exposure
- Monitor for suspicious symbolic link creation in apport-related directories
🔍 How to Verify
Check if Vulnerable:
Check apport version: dpkg -l | grep apport and verify if pre-fix versionCheck Version:
dpkg -l | grep apportVerify Fix Applied:
Verify apport package version is updated and check for presence of fix in changelog📡 Detection & Monitoring
Log Indicators:
- Apport crash reports accessing unusual file paths
- Multiple failed apport hook executions
Network Indicators:
- None - local-only vulnerability
SIEM Query:
process.name:apport AND file.path:*symlink* OR file.path:*fifo*