Local privilege escalation via symlinked lock directory

Privilege escalation in Canonical Apport on affected Ubuntu releases allows local users to gain elevated access via a symlink attack. The data/apport launcher creates a root-owned, world-writable lock file under /var/lock/apport and trusts an existing user-controlled directory, allowing its lock path to be redirected through a symlink. A low-privileged local account must create the symlink before Apport opens the lock file; successful exploitation redirects a root-created file and enables privilege escalation.