CVE-2025-5054

Published May 30, 2025

Last updated a day ago

Canonical Apport

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-5054 is a race condition vulnerability found in Canonical's Apport, a core dump handler in Ubuntu. Specifically, it affects versions up to and including 2.32.0. This vulnerability allows a local attacker to potentially leak sensitive information by exploiting PID reuse, leveraging namespaces. The vulnerability arises because Apport, when handling crashes, attempts to detect if the crashing process was running inside a container *before* performing consistency checks. If an attacker can induce a crash in a privileged process and quickly replace it with another process having the same process ID within a mount and PID namespace, Apport might forward the core dump (containing sensitive information from the original process) into the container. To exploit this, an attacker needs permissions to create user, mount, and PID namespaces with full capabilities.

Description: Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only forwarded to containers if the kernel provided a pidfd, or if the crashing process was unprivileged (i.e., if dump mode == 1).
Source: security@ubuntu.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 4.7
Impact score: 3.6
Exploitability score: 1
Vector string: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

security@ubuntu.com: CWE-362

Hype score: Not currently trending

References