CVE-2020-15702

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges. Fixed in 2.20.1-0ubuntu2.24, 2.20.9 versions prior to 2.20.9-0ubuntu7.16 and 2.20.11 versions prior to 2.20.11-0ubuntu27.6. Was ZDI-CAN-11234.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
Canonical	apport	>= 2.20.1, < 2.20.1-0ubuntu2.24; >= 2.20.9, < 2.20.9-0ubuntu7.16; >= 2.20.11, < 2.20.11-0ubuntu27.6

References

https://usn.ubuntu.com/4449-1Vendor Advisory
https://usn.ubuntu.com/4449-1/Vendor Advisory
https://usn.ubuntu.com/4449-2/Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-979/Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2025/Jun/9
https://usn.ubuntu.com/4449-1Vendor Advisory
https://usn.ubuntu.com/4449-1/Vendor Advisory
https://usn.ubuntu.com/4449-2/Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-979/Third Party Advisory, VDB Entry

Timeline

Published: Aug 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-157033.3There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directo CVE-2020-157045.5The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-roo CVE-2020-157056.4GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems w CVE-2020-157066.4GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefin CVE-2020-157076.4Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in De CVE-2020-157087.8Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to ove CVE-2020-157095.5Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package arch CVE-2020-15717.3An elevation of privilege vulnerability exists in Windows Setup in the way it handles permissions. A locally authenticated attacker could ru CVE-2020-157106.1Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable CVE-2020-157118.8In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.CVE-2020-157124.3rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to CVE-2020-157138.8rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.php script us