apport: Race condition in Canonical apport up to and including 2.32.0 allows alocal attacker to leak sensitive information vi...

Race condition in Canonical apport up to and including 2.32.0 allows alocal attacker to leak sensitive information via PID-reuse by leveragingnamespaces.When handling a crash, the function `_check_global_pid_and_forward`, whichdetects if the crashing process resided in a container, was being calledbefore `consistency_checks`, which attempts to detect if the crashingprocess had been replaced. Because of this, if a process crashed and wasquickly replaced with a containerized one, apport could be made to forwardthe core dump to the container, potentially leaking sensitive information.`consistency_checks` is now being called before`_check_global_pid_and_forward`. Additionally, given that the PID-reuserace condition cannot be reliably detected from userspace alone, crashesare only forwarded to containers if the kernel provided a pidfd, or if thecrashing process was unprivileged (i.e., if dump mode == 1).

Where it's fixed