Canonical ubuntu-pro-client symlink following exposes root-readable files through pro collect-logs

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.

The supplied affected facts identify ubuntu-pro-client versions less than 37.3 as affected. Canonical's status information provides these branch-specific package fixes:

• Ubuntu 26.04 LTS: ubuntu-advantage-tools fixed in 37.2ubuntu0.1.
• Ubuntu 24.04 LTS: fixed in 37.2ubuntu~24.04.1.
• Ubuntu 22.04 LTS: fixed in 37.2ubuntu~22.04.1.
• Ubuntu 20.04 LTS: fixed in 37.1ubuntu0~20.04.1; the fix is available through Ubuntu Pro.
• Ubuntu 18.04 LTS: fixed in 37.1ubuntu0~18.04.1; the fix is available through Ubuntu Pro.
• Ubuntu 16.04 LTS: fixed in 37.1ubuntu0~16.04.1; the fix is available through Ubuntu Pro with the Legacy Support add-on.
• Ubuntu 14.04 LTS: listed by Canonical as not affected.
• Ubuntu 25.10: listed by Canonical as ignored because it is end of life; the consulted status page does not provide a fixed package version for this branch.

The Canonical advisory describes the symlink issue as affecting Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS and 26.04 LTS. The status of one parallel branch must not be inferred solely from a fix published for another branch.

The flaw is in the pro collect-logs command framework, which gathers logs through predictable temporary paths or user-accessible log directories. The utility does not adequately verify file type or ownership before processing those entries.

1. An unprivileged local attacker creates a symlink at a predictable destination, pointing to a file readable by root.
2. A root administrator or operator later runs pro collect-logs, causing the tool to follow the attacker-controlled symlink and read the target file.
3. The contents are placed in the diagnostic support archive, which remains readable by the unprivileged user.

This behavior matches CWE-59, Improper link resolution before file access. The available evidence does not establish the exact temporary path, log directory, or archive format for every deployment.

The vulnerability is locally reachable by an unprivileged user. Exploitation requires the attacker to create a symlink where pro collect-logs will process it, followed by an administrator or operator running the log collection command.

• The recorded attack complexity is low.
• User interaction is required because a privileged operator must subsequently run pro collect-logs.
• The outcome depends on the generated archive being readable by the unprivileged user.
• The supplied record does not identify a public exploit and does not establish active exploitation.

The confirmed technical outcome is information disclosure: the contents of a file readable by root can be included in a diagnostic support archive and read by an unprivileged local user. The affected scope is host confidentiality; the available evidence does not confirm an integrity or availability effect.

• Private administrator files or other sensitive data may be exposed if they are selected as the symlink target.
• The vulnerability does not by itself establish write access, code execution, or privilege escalation; the confirmed consequence is unauthorized reading and disclosure.
• Actual damage depends on which files the root process can read and what content is collected into the archive.
• If an archive was accessed without authorization, assess the exposed data, related accounts or secrets, and preserve evidence for investigation.

The flaw can expose sensitive information from administrator-owned files, including credentials, private configuration, or system secrets if those files are read into the support archive. The primary risk is loss of confidentiality on the host and possible exposure of authentication material or operational data stored in root-readable files.

• A leaked archive may allow a local user to read data beyond their normal permissions.
• The evidence does not confirm modification of files or service disruption.
• If an investigation confirms that sensitive data was placed in an archive accessible to an unauthorized user, the organization should assess the exposure and consider rotating related credentials or secrets.

1. Update the package for the Ubuntu branch in use. The package versions confirmed by Canonical are 37.2ubuntu0.1 for Ubuntu 26.04 LTS, 37.2ubuntu~24.04.1 for Ubuntu 24.04 LTS, 37.2ubuntu~22.04.1 for Ubuntu 22.04 LTS, 37.1ubuntu0~20.04.1 for Ubuntu 20.04 LTS, 37.1ubuntu0~18.04.1 for Ubuntu 18.04 LTS and 37.1ubuntu0~16.04.1 for Ubuntu 16.04 LTS.
2. On Ubuntu 20.04 LTS, 18.04 LTS and 16.04 LTS, confirm that the system has the Ubuntu Pro or Legacy Support entitlement required to receive the applicable fix.
3. If an update cannot be applied immediately, temporarily avoid running pro collect-logs as root on systems with untrusted local users, and keep generated archives in root-only storage. This is operational risk reduction, not a replacement for updating.
4. After updating, verify the installed package version and confirm that the patched behavior rejects symlink log files in user-controlled directory trees and limits generated support archive permissions to root.
5. Canonical lists Ubuntu 14.04 LTS as not affected. Ubuntu 25.10 requires separate end-of-life handling because the consulted source does not state a fixed package version for that branch.

• Inventory systems running ubuntu-pro-client or ubuntu-advantage-tools, and identify Ubuntu branches that have not received the applicable package update.
• Identify systems that run pro collect-logs as root, especially multi-user systems or systems with log directories writable by local users.
• Inspect relevant log directory trees for symlinks and verify that collected entries are ordinary log files rather than links to sensitive files.
• Check the ownership and permissions of existing diagnostic support archives. Canonical's fix rejects symlink log files in user-controlled directory trees and restricts generated support archive permissions to root only.
• Review existing archives for content outside the expected diagnostic logs. No specific IOC or log event is established by the available evidence, and absence of a finding does not prove that a system is safe.