Read the docs
TI-2021-02809 Aliases CVE-2021-3899GHSA-m676-gr96-hhhh

Time-of-check time-of-use race condition in Canonical Apport

Priority LOW 36CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Fixed Apport (Canonical Ltd.): 2.21.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalApportbefore 2.21.02.21.0Patch availableCNA
  • Apport VendorCanonical Affected before 2.21.0 Fixed in 2.21.0 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*before 2.21.0VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*21.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*22.04VulnerableCanonical
  • cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:* Versions before 2.21.0 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:* Versions 21.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* Versions 22.04 Vulnerable ·Canonical

Remediation

  • Fix · CNA Apport (Canonical Ltd.) Fixed in 2.21.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Canonical Apport — ubuntu.com/security/notices/USN-5427-1

    8 records Highest priority Priority LOW 8 LOW

    Other records, highest priority first

    • TI-2022-11302 Apport does not disable python crash handler before entering chrootPriority LOW 35
    • TI-2022-01129 Apport can be tricked into connecting to arbitrary sockets as the root userPriority LOW 33
    • TI-2022-11300 is_closing_session() allows users to create arbitrary tcp dbus connectionsPriority LOW 31
    Show all 8 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3899
  2. 2026-10-03 Alias added: GHSA-m676-gr96-hhhh

References

Patch 1

Advisory 2

  • TI-2025-04530 Race Condition in Canonical Apport CVSS 3.1MEDIUM 4.7
  • TI-2020-09600 gdbus setgid privilege escalation CVSS 3.1LOW 3.1
  • TI-2025-04908 Ubuntu Apport Insecure File Permissions Vulnerability CVSS 4.0LOW 1.9
  • TI-2022-11298 Users can consume unlimited disk space in /var/crash CVSS 3.1HIGH 7.5
  • TI-2021-07816 apport can be stalled by reading a FIFO CVSS 3.1HIGH 8.8
  • TI-2023-01253 local privilege escalation in apport-cli CVSS 3.1HIGH 7.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences