CVE-2020-8833: Apport race condition in crash report permissions
Last updated 25 August 2025
Other sources
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protectedsymlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
— Launchpad
Affected Software
Remediation
Mitigation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-8833?
CVE-2020-8833 is classified as a medium severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2020-8833?
To mitigate CVE-2020-8833, ensure that fs.protected_symlinks is enabled in the system configuration.
Which versions of Ubuntu are affected by CVE-2020-8833?
CVE-2020-8833 affects Ubuntu 14.04, 16.04, 18.04, and 19.10.
What type of vulnerability is CVE-2020-8833?
CVE-2020-8833 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability.
Can CVE-2020-8833 be exploited remotely?
CVE-2020-8833 requires local access to the system to exploit, making remote exploitation unlikely.