CVE-2022-28652
📋 TL;DR
This vulnerability in Apport's settings file parsing allows a billion laughs attack (XML entity expansion) that can cause denial of service through excessive memory consumption. It affects Ubuntu systems with Apport installed and configured to use the vulnerable settings parsing. The attack requires local access to create or modify the settings file.
💻 Affected Systems
- Apport
📦 What is this software?
Apport by Apport Project
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability due to memory exhaustion, potentially requiring reboot and causing service disruption.
Likely Case
Apport process crash or system slowdown when malicious settings file is parsed, affecting crash reporting functionality.
If Mitigated
Minimal impact with proper file permissions preventing unauthorized settings file creation/modification.
🎯 Exploit Status
Exploitation requires local access to create or modify the settings XML file. The attack technique (billion laughs) is well-known and easy to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apport 2.20.11-0ubuntu82.1 and later
Vendor Advisory: https://ubuntu.com/security/notices/USN-5427-1
Restart Required: No
Instructions:
1. Update system: sudo apt update && sudo apt upgrade
2. Specifically update apport: sudo apt install --only-upgrade apport
3. Verify version: dpkg -l apport
🔧 Temporary Workarounds
Restrict settings file permissions
linuxSet strict permissions on the apport settings directory to prevent unauthorized modifications
chmod 700 ~/.config/apport/
chmod 600 ~/.config/apport/settings
Disable Apport
linuxTemporarily disable Apport crash reporting if not needed
sudo systemctl stop apport
sudo systemctl disable apport
🧯 If You Can't Patch
- Implement strict file permissions on ~/.config/apport/ directory (chmod 700) and settings file (chmod 600)
- Monitor for unauthorized modifications to apport settings files using file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check Apport version: dpkg -l apport | grep ^iiCheck Version:
dpkg -l apport | grep ^ii | awk '{print $3}'Verify Fix Applied:
Verify installed version is 2.20.11-0ubuntu82.1 or later: dpkg -l apport📡 Detection & Monitoring
Log Indicators:
- Apport process crashes with memory errors
- System logs showing out-of-memory conditions when apport runs
Network Indicators:
- None - local file system attack
SIEM Query:
process:name=apport AND (event:out_of_memory OR event:crash)