CVE-2021-3899
📋 TL;DR
CVE-2021-3899 is a race condition vulnerability in Apport's 'replaced executable' detection mechanism that allows local attackers to execute arbitrary code with root privileges. This affects Ubuntu systems with Apport installed and configured to handle crash reports. Attackers need local access and specific configuration conditions to exploit this.
💻 Affected Systems
- Apport
📦 What is this software?
Apport by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Full root compromise allowing complete system takeover, data exfiltration, persistence establishment, and lateral movement within the network.
Likely Case
Local privilege escalation from a standard user to root, enabling installation of backdoors, credential theft, and further system compromise.
If Mitigated
No impact if Apport is disabled or patched; limited impact if proper access controls and monitoring are in place.
🎯 Exploit Status
Exploitation requires local access and race condition timing; proof-of-concept exists in bug reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apport 2.20.11-0ubuntu82.1 and later
Vendor Advisory: https://ubuntu.com/security/notices/USN-5427-1
Restart Required: No
Instructions:
1. Update package list: sudo apt update 2. Upgrade Apport: sudo apt install --only-upgrade apport 3. Verify version: dpkg -l apport
🔧 Temporary Workarounds
Disable Apport
linuxCompletely disable Apport crash reporting service
sudo systemctl stop apport
sudo systemctl disable apport
sudo sed -i 's/enabled=1/enabled=0/' /etc/default/apport
🧯 If You Can't Patch
- Restrict local user access to systems with Apport enabled
- Implement strict file permission controls and monitor for suspicious process execution
🔍 How to Verify
Check if Vulnerable:
Check Apport version: dpkg -l apport | grep ^iiCheck Version:
dpkg -l apport | grep ^ii | awk '{print $3}'Verify Fix Applied:
Verify installed version is 2.20.11-0ubuntu82.1 or higher: dpkg -l apport📡 Detection & Monitoring
Log Indicators:
- Unusual Apport process activity
- Suspicious crash report generation
- Unexpected privilege escalation attempts
Network Indicators:
- None - local exploitation only
SIEM Query:
process_name:"apport" AND (parent_process_name NOT IN ["systemd", "init"]) OR process_name:"apport" AND command_line:"/tmp/*"🔗 References
- https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1948376
- https://ubuntu.com/security/notices/USN-5427-1
- https://www.cve.org/CVERecord?id=CVE-2021-3899
- https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1948376
- https://ubuntu.com/security/notices/USN-5427-1
- https://www.cve.org/CVERecord?id=CVE-2021-3899
