Privilege escalation via misparsed process start time

Improper input validation in Canonical Apport on affected Ubuntu releases allows local users to bypass process-replacement checks. The get_starttime() function splits /proc/PID/stat on spaces and assumes the process start time remains field 22, so spaces in a process name shift the fields and yield a false timestamp. A low-privileged local user can recycle a PID and use the misparsed timestamp to bypass Apport's process-replacement check, completing a crash-handler exploit chain that writes attacker-controlled content with root privileges.