CVE-2021-32555: apport read_file() function could follow maliciously constructed symbolic links
Published Jun 12, 2021
·Updated
It was discovered that readfile() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users.
Affected Software
5 affected components
Ubuntu=18.04
Ubuntu=20.04
Ubuntu=20.10
Ubuntu=21.04
Ubuntu=21.10
Event History
Jun 12, 2021
CVE Published
via MITRE·03:40 AM
Data Sourced
via MITRE·03:40 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-32555?
CVE-2021-32555 has a medium severity rating, as it can expose private data to local users.
2
How do I fix CVE-2021-32555?
To fix CVE-2021-32555, ensure you update your Ubuntu system to the latest patched version.
3
What systems are affected by CVE-2021-32555?
CVE-2021-32555 affects Ubuntu Linux versions 18.04, 20.04, 20.10, 21.04, and 21.10.
4
What does CVE-2021-32555 exploit?
CVE-2021-32555 exploits the read_file() function in apport/hookutils.py, allowing access to private data via symbolic links.
5
Is user data at risk due to CVE-2021-32555?
Yes, CVE-2021-32555 can potentially expose user data to other local users on the affected Ubuntu systems.