Linux Crash Report Vulnerabilities: A Comedy of Errors Exposing Sensitive Data
Local vulnerabilities in Linux crash-reporting tools Apport and systemd-coredump give attackers access to sensitive data. These race-condition flaws, identified by the Qualys Threat Research Unit, allow users to exploit SUID programs to extract password hashes. Administrators should patch these vulnerabilities promptly to prevent potential data breaches.
Hot Take:
Looks like Linux’s crash-reporting tools are having a “whoopsie” moment, and unfortunately, it’s not the kind you can just laugh off. When your crash handlers are handing out password hashes like candy, it’s time to seriously reconsider your life choices—or at least your system configurations.
Key Points:
- Two vulnerabilities target Apport on Ubuntu and systemd-coredump on RHEL and Fedora.
- These are race-condition flaws that allow core dumps to be exploited to extract sensitive data.
- Proof-of-concept showed password hashes could be accessed using the unix_chkpwd utility.
- Affected systems include Apport up to version 2.33.0 on Ubuntu and systemd-coredump on Fedora and RHEL.
- Administrators should disable core dumps, apply patches, and tighten access controls.
Already a member? Log in here