CVE-2021-25682: apport improperly parses /proc/pid/status
Published Jun 11, 2021
·Updated
It was discovered that the getpidinfo() function in data/apport did not properly parse the /proc/pid/status file from the kernel.
Affected Software
4 affected components
Canonical apport>=2.20.1-0ubuntu1<2.20.1-0ubuntu2.30
Canonical apport>=2.20.9-0ubuntu1<2.20.9-0ubuntu7.23
Canonical apport>=2.20.11-0ubuntu27<2.20.11-0ubuntu27.16
Canonical apport>=2.20.11-0ubuntu50<2.20.11-0ubuntu50.5
Event History
Jun 11, 2021
CVE Published
via MITRE·02:20 AM
Data Sourced
via MITRE·02:20 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2021-25682?
CVE-2021-25682 is a vulnerability that allows attackers to obtain sensitive information from the /proc/pid/status file in the kernel.
2
How does CVE-2021-25682 impact Canonical Apport?
CVE-2021-25682 affects Canonical Apport versions 2.20.1-0ubuntu2.30 and earlier, 2.20.9-0ubuntu7.23 and earlier, 2.20.11-0ubuntu27.16 and earlier, and 2.20.11-0ubuntu50.5 and earlier.
3
What is the severity of CVE-2021-25682?
CVE-2021-25682 has a severity score of 7.8 (High).
4
How can I fix CVE-2021-25682?
To fix CVE-2021-25682, it is recommended to update to the latest version of Canonical Apport.
5
Where can I find more information about CVE-2021-25682?
You can find more information about CVE-2021-25682 at the following reference: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1912326