--- title: Apport local information disclosure vulnerability fixes available description: Canonical's security team has released updates for the apport local information disclosure vulnerability - CVE-2025-5054. url: https://canonical.com/blog/apport-local-information-disclosure-vulnerability-fixes-available?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Octavio Galland](https://canonical.com/blog/author/octagalland "More about Octavio Galland") 30 May 2025 # Apport local information disclosure vulnerability fixes available [Security](https://canonical.com/blog/tag/security) [Vulnerabilities](https://canonical.com/blog/tag/vulnerabilities) --- Share the article Qualys discovered two vulnerabilities in various Linux distributions which allow a local attacker with permission to create user namespaces to leak core dumps for processes of suid executables. These affect both apport, the Ubuntu default core dump handler ([CVE-2025-5054](https://ubuntu.com/security/CVE-2025-5054)), and systemd-coredump, the default core dump handler in Red Hat Enterprise Linux, Fedora and other Linux distributions ([CVE-2025-4598](https://www.cve.org/CVERecord?id=CVE-2025-4598)). CVE-2025-4598 does not affect default Ubuntu installations, unless it was manually set as the core dump handler by installing the systemd-coredump package. The vulnerabilities have a CVSS score of 4.7 (MEDIUM), requiring local access and high attack complexity. The impact is restricted to the confidentiality of the memory space of invoked suid executables. The exploit demonstrated by Qualys can leak hashed user passwords and, as such, has limited real-world impact. Canonical’s security team has released updates for the apport package for all affected Ubuntu releases. This package is installed by default in all Ubuntu Server images and Ubuntu Desktop installations. The update remediates [CVE-2025-5054](https://ubuntu.com/security/CVE-2025-5054). Information on the affected versions can be found in the CVE page linked above. If you have any of these installed, our recommendation is to update as soon as possible. # How the exploit works Qualys discovered that, when analyzing application crashes, apport attempts to detect if the crashing process was running inside a container before performing consistency checks on it. This means that if a local attacker manages to induce a crash in a privileged process and quickly replaces it with another one with the same process ID that resides inside a mount and pid namespace, apport will attempt to forward the core dump (which might contain sensitive information belonging to the original, privileged process) into the namespace. In order to successfully carry out the exploit, an attacker must have permissions to create user, mount and pid namespaces with full capabilities. # Affected releases | | | | | --- | --- | --- | | **Release** | **Package Name** | **Fixed Version** | | Trusty (14.04) | apport | Not affected | | Xenial (16.04) | apport | 2.20.1-0ubuntu2.30+esm5 | | Bionic (18.04) | apport | 2.20.9-0ubuntu7.29+esm1 | | Focal (20.04) | apport | 2.20.11-0ubuntu27.28 | | Jammy (22.04) | apport | 2.20.11-0ubuntu82.7 | | Noble (24.04) | apport | 2.28.1-0ubuntu3.6 | | Oracular (24.10) | apport | 2.30.0-0ubuntu4.3 | | Plucky (25.04) | apport | 2.32.0-0ubuntu5.1 | | Trusty (14.04) | systemd-coredump | Not present | | Xenial (16.04) | systemd-coredump | Not affected | | Bionic (18.04) | systemd-coredump | Not affected | | Focal (20.04) | systemd-coredump | 245.4-4ubuntu3.24+esm1 | | Jammy (22.04) | systemd-coredump | 249.11-0ubuntu3.16 | | Noble (24.04) | systemd-coredump | 255.4-1ubuntu8.8 | | Oracular (24.10) | systemd-coredump | 256.5-2ubuntu3.3 | | Plucky (25.04) | systemd-coredump | 257.4-1ubuntu3.1 | # How to check if you are impacted On your system, run the following command and compare the listed version to the table above. ``` apt list --installed | grep "^\(apport\|systemd-coredump\)" ``` # How to address We recommend you upgrade all packages: ``` sudo apt update && sudo apt upgrade ``` If this is not possible, the affected component can be targeted. If using apport (the default): ``` # on focal and newer: sudo apt update && sudo apt install --only-upgrade apport python3-apport # on xenial and bionic: sudo apt update && sudo apt install --only-upgrade apport python3-apport python-apport ``` If using system-coredump: ``` sudo apt update && sudo apt install --only-upgrade systemd-coredump ``` The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service: * Applies new security updates every 24 hours automatically. * If you have this enabled, the patches above will be automatically applied within 24 hours of being available. # Mitigation The strongest protection is to apply the security updates. The following mitigations have also been explored. If security updates cannot be applied, **you should only apply the following steps as a last resort** and revert the configuration once updates are applied. The ability to obtain core dumps of suid executable processes can be completely disabled by setting the fs.suid\_dumpable sysctl to 0. While this completely neutralizes the vulnerability, it also restricts the ability to investigate crashes for all processes which change privileges upon execution.. ``` echo "fs.suid_dumpable = 0" | sudo tee /etc/sysctl.d/10-cve-2025-5054.conf sudo sysctl -p /etc/sysctl.d/10-cve-2025-5054.conf ``` # Acknowledgements We would like to thank Qualys for their excellent reporting and for inviting the Ubuntu Security Team to coordinate this issue. # Timeline * A correction to this blog post was implemented on 2 June 2025 to clarify that CVE-2025-4598 may affect Ubuntu installations where systemd-coredump was manually installed to replace apport as the default core dump handler. # References [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### PinTheft Linux kernel vulnerability mitigation](https://canonical.com/blog/pintheft-linux-kernel-vulnerability-mitigation) A local privilege escalation (LPE) security vulnerability in the Linux kernel, codename “PinTheft,” was publicly disclosed on May 19, 2026. The vulnerability was fixed in the... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 21 May 2026