CVE-2025-5467
📋 TL;DR
This vulnerability in Canonical's Apport crash reporting tool creates crash files with incorrect group ownership, potentially exposing sensitive crash information to unauthorized users. It affects Ubuntu systems with Apport enabled. The exposure is limited to local users who can access files with incorrect permissions.
💻 Affected Systems
- Canonical Apport
📦 What is this software?
Apport by Canonical
Apport by Canonical
Apport by Canonical
Apport by Canonical
Apport by Canonical
Apport by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Sensitive system information from crash reports could be accessed by unauthorized local users, potentially revealing configuration details, memory contents, or other data that could aid further attacks.
Likely Case
Limited information disclosure to local users who happen to be in groups that shouldn't have access to crash files, potentially exposing some system details but not critical secrets.
If Mitigated
Minimal impact with proper file permissions and group management in place, as the vulnerability only affects group ownership, not world-readable permissions.
🎯 Exploit Status
Exploitation requires local user access to the system and ability to read files in directories where crash reports are stored.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Ubuntu security updates for Apport package
Vendor Advisory: https://bugs.launchpad.net/apport/+bug/2106338
Restart Required: No
Instructions:
1. Run 'sudo apt update' 2. Run 'sudo apt upgrade apport' 3. Verify the update completed successfully
🔧 Temporary Workarounds
Disable Apport
linuxCompletely disable the Apport crash reporting service
sudo systemctl stop apport
sudo systemctl disable apport
echo 'enabled=0' | sudo tee /etc/default/apport
Restrict crash directory permissions
linuxManually set correct permissions on Apport crash directories
sudo chmod 750 /var/crash
sudo chown root:adm /var/crash
🧯 If You Can't Patch
- Disable Apport crash reporting service entirely
- Implement strict file permission monitoring on /var/crash directory
🔍 How to Verify
Check if Vulnerable:
Check if Apport is running: 'systemctl status apport' and check Apport version: 'dpkg -l | grep apport'Check Version:
dpkg -l | grep apportVerify Fix Applied:
Check Apport package version after update and verify /var/crash directory permissions: 'ls -la /var/crash'📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /var/crash directory
- Failed permission attempts on crash files
Network Indicators:
- None - this is a local file system vulnerability
SIEM Query:
Process monitoring for unusual file reads from /var/crash/* or permission changes to crash files