LiveActive security incident?Get immediate response
CVE Record

CVE-2018-6552: Apport treats the container PID as the global PID when /proc/<global_pid>/ is missing

Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers. The is_same_ns() function returns True when /proc/<global pid>/ does not exist in order to indicate that the crash should be handled in the global namespace rather than inside of a container. However, the portion of the data/apport code that decides whether or not to forward a crash to a container does not always replace sys.argv[1] with the value stored in the host_pid variable when /proc/<global pid>/ does not exist which results in the container pid being used in the global namespace. This flaw affects versions 2.20.8-0ubuntu4 through 2.20.9-0ubuntu7, 2.20.7-0ubuntu3.7, 2.20.7-0ubuntu3.8, 2.20.1-0ubuntu2.15 through 2.20.1-0ubuntu2.17, and 2.14.1-0ubuntu3.28.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Ubuntu's Apport crash reporting could mishandle crashes from containers and treat a container PID as a host PID. A local user could cause files to be created as root, leading to denial of service, possible privilege escalation, or possible container escape. The sources do not provide CVSS, severity, or confirmed exploitation.

Executive priority

Treat this as high priority for Ubuntu container hosts and shared systems. The attack requires local access, but the potential outcomes include root-level file creation, denial of service, and possible container escape. No confirmed active exploitation is cited.

Technical view

Apport's PID namespace handling can return to global-namespace processing when /proc/<global_pid>/ is missing, but the crash-forwarding path may keep sys.argv[1] as the container PID instead of host_pid. This affects listed Ubuntu Apport package versions across 2.14.1, 2.20.1, 2.20.7, 2.20.8, and 2.20.9 package lines.

Likely exposure

Exposure is most relevant on Ubuntu systems running the affected Apport package versions, especially container hosts or systems where untrusted local users can trigger crashes.

Exploitation context

The bundle describes a local attack surface. It does not cite KEV listing, public active exploitation, or exploit availability. Potential impacts include resource exhaustion, possible root privilege gain, or possible container escape, but evidence of real-world exploitation is not provided.

Researcher notes

Focus validation on PID namespace crash handling and package lineage. The source bundle explains the vulnerable decision path but does not provide CVSS, fixed version details, exploit status, or reproduction guidance. Avoid assuming all Apport versions are affected beyond the listed package ranges.

Mitigation direction

  • Review Ubuntu USN-3664-1 and USN-3664-2 for fixed Apport packages.
  • Update affected Ubuntu systems to the vendor-provided Apport packages.
  • Prioritize container hosts and multi-user systems with local untrusted access.
  • Reduce unnecessary local shell access until affected systems are updated.
  • Check vendor guidance before applying nonstandard workarounds.

Validation and detection

  • Inventory Ubuntu hosts and container hosts running Apport.
  • Compare installed Apport packages with the affected versions listed in the CVE record.
  • Confirm applicable Ubuntu USN updates are installed.
  • Review whether untrusted users or containers can trigger Apport crash handling.
  • Document residual exposure where vendor updates are unavailable.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-6552 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aApport2.20.8-0ubuntu4, unspecifiedListed
n/aApport2.20.1-0ubuntu2.15, unspecifiedListed
n/aApport2.20.7-0ubuntu3.7, unspecifiedListed
n/aApport2.14.1-0ubuntu3.28Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.