Skip to content
Fencer Vulns
medium 4.7

CVE-2025-5054 json

Race Condition in Canonical Apport

published 2025-05-30 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16511

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces.

When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only forwarded to containers if the kernel provided a pidfd, or if the crashing process was unprivileged (i.e., if dump mode == 1).

Patch / fix

  • Canonical Apport 2.20.1-0ubuntu2.30+esm5, 2.20.9-0ubuntu7.29+esm1, 2.20.11-0ubuntu27.28, 2.20.11-0ubuntu82.7, 2.28.1-0ubuntu3.6, 2.30.0-0ubuntu4.3, 2.32.0-0ubuntu5.1, 2.33.0-0ubuntu1
  • apport Ubuntu 20.04 LTS 2.20.11-0ubuntu27.28
  • apport Ubuntu 22.04 LTS 2.20.11-0ubuntu82.7
  • apport Ubuntu 24.04 LTS 2.28.1-0ubuntu3.6
  • apport Ubuntu Pro 16.04 LTS 2.20.1-0ubuntu2.30+esm5
  • apport Ubuntu Pro 18.04 LTS 2.20.9-0ubuntu7.29+esm1

ubuntu advisories UBUNTU-CVE-2025-5054

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • qualys.com https://www.qualys.com/2025/05/29/apport-coredump/apport-coredump.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Canonical Apport

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.