CVE-2019-11483 : Security Advisory and Response

Sander Bos identified a flaw in the handling of crash dumps by Apport when they originate from containers. Exploiting this vulnerability could allow a local attacker to create a crash report for a privileged process that can be accessed by an unprivileged user.

Understanding CVE-2019-11483

This CVE involves a vulnerability in Apport that could be exploited by a local attacker to generate a crash report for a privileged process accessible by an unprivileged user.

What is CVE-2019-11483?

CVE-2019-11483 is a vulnerability in Apport that mishandles crash dumps originating from containers, potentially allowing unauthorized access to sensitive crash reports.

The Impact of CVE-2019-11483

CVSS Base Score: 7.0 (High Severity)
Attack Vector: Local
Confidentiality Impact: High
Integrity Impact: Low
Privileges Required: Low
Scope: Changed
User Interaction: None
Availability Impact: Low

Technical Details of CVE-2019-11483

This section provides detailed technical information about the CVE-2019-11483 vulnerability.

Vulnerability Description

The vulnerability in Apport allows a local attacker to create crash reports for privileged processes that can be accessed by unprivileged users, potentially leading to unauthorized access to sensitive information.

Affected Systems and Versions

The following versions of Apport are affected:

Version 2.14.1-0ubuntu3.29+esm2
Version 2.20.1-0ubuntu2.20
Version 2.20.9-0ubuntu7.8
Version 2.20.11-0ubuntu8.1

Exploitation Mechanism

The vulnerability can be exploited by a local attacker to manipulate crash dumps originating from containers, enabling the creation of crash reports for privileged processes.

Mitigation and Prevention

To address CVE-2019-11483, follow these mitigation and prevention measures:

Immediate Steps to Take

Update Apport to a non-vulnerable version.
Monitor system logs for any suspicious activities.
Restrict access to sensitive crash reports.

Long-Term Security Practices

Implement container security best practices.
Regularly update and patch software to prevent vulnerabilities.

Patching and Updates

Apply patches provided by Canonical to fix the vulnerability in Apport.