Read the docs
TI-2025-04530 Aliases CVE-2025-5054GHSA-4c8w-67qj-c8vp

Race Condition in Canonical Apport

Priority MEDIUM 55CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only forwarded to containers if the kernel provided a pidfd, or if the crashing process was unprivileged (i.e., if dump mode == 1).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00784 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Apport (Canonical): 2.20.1-0ubuntu2.30+esm5, 2.20.9-0ubuntu7.29+esm1, 2.20.11-0ubuntu27.28 +5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalApport2.20.1 to before 2.20.1-0ubuntu2.30+esm5; 2.20.9 to before 2.20.9-0ubuntu7.29+esm1; 2.20.11 to before 2.20.11-0ubuntu27.28; 2.20.11 to before 2.20.11-0ubuntu82.7; 2.28.1 to before 2.28.1-0ubuntu3.6; 2.30.0 to before 2.30.0-0ubuntu4.3; 2.32.0 to before 2.32.0-0ubuntu5.1; 2.32.0 to before 2.33.0-0ubuntu1; 2.20 – 2.32.02.20.1-0ubuntu2.30+esm5, 2.20.9-0ubuntu7.29+esm1, 2.20.11-0ubuntu27.28, 2.20.11-0ubuntu82.7, 2.28.1-0ubuntu3.6, 2.30.0-0ubuntu4.3, 2.32.0-0ubuntu5.1, 2.33.0-0ubuntu1Patch availableCNA
  • Apport VendorCanonical Affected 2.20.1 to before 2.20.1-0ubuntu2.30+esm5; 2.20.9 to before 2.20.9-0ubuntu7.29+esm1; 2.20.11 to before 2.20.11-0ubuntu27.28; 2.20.11 to before 2.20.11-0ubuntu82.7; 2.28.1 to before 2.28.1-0ubuntu3.6; 2.30.0 to before 2.30.0-0ubuntu4.3; 2.32.0 to before 2.32.0-0ubuntu5.1; 2.32.0 to before 2.33.0-0ubuntu1; 2.20 – 2.32.0 Fixed in 2.20.1-0ubuntu2.30+esm5, 2.20.9-0ubuntu7.29+esm1, 2.20.11-0ubuntu27.28, 2.20.11-0ubuntu82.7, 2.28.1-0ubuntu3.6, 2.30.0-0ubuntu4.3, 2.32.0-0ubuntu5.1, 2.33.0-0ubuntu1 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*up to 2.32.0VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*22.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*24.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:*:*:*:*24.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:25.04:*:*:*:*:*:*:*25.04VulnerableCanonical
  • cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:* Versions up to 2.32.0 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* Versions 22.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:* Versions 24.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:*:*:*:* Versions 24.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:25.04:*:*:*:*:*:*:* Versions 25.04 Vulnerable ·Canonical

Remediation

  • Fix · CNA Apport (Canonical) Fixed in 2.20.1-0ubuntu2.30+esm5, 2.20.9-0ubuntu7.29+esm1, 2.20.11-0ubuntu27.28, 2.20.11-0ubuntu82.7, 2.28.1-0ubuntu3.6, 2.30.0-0ubuntu4.3, 2.32.0-0ubuntu5.1, 2.33.0-0ubuntu1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5054
  2. 2026-10-03 Alias added: GHSA-4c8w-67qj-c8vp

References

Exploit 1

Advisory 2

  • TI-2020-09600 gdbus setgid privilege escalation CVSS 3.1LOW 3.1
  • TI-2025-04908 Ubuntu Apport Insecure File Permissions Vulnerability CVSS 4.0LOW 1.9
  • TI-2022-11298 Users can consume unlimited disk space in /var/crash CVSS 3.1HIGH 7.5
  • TI-2021-07816 apport can be stalled by reading a FIFO CVSS 3.1HIGH 8.8
  • TI-2023-01253 local privilege escalation in apport-cli CVSS 3.1HIGH 7.8
  • TI-2021-07815 apport improperly parses /proc/pid/stat CVSS 3.1HIGH 8.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences