Ubuntu Pro For Wsl
Monthly
Local information disclosure in the wsl-pro-service component of Ubuntu Pro for WSL (versions before 0.1.19ubuntu3) lets any unprivileged user or process sharing a WSL instance read the Ubuntu Pro attach token while the root-run service executes `pro attach <token> --format=json`; the token sits in cleartext in /proc/<pid>/cmdline, which remains world-readable in WSL because /proc is mounted without hidepid. Because the token is a bearer credential for the subscription, an attacker who wins the short race window can attach their own machines to the victim's Ubuntu Pro subscription and consume its entitlements and services. Exploitation requires a pre-existing local account inside the WSL instance, the WSL-default (non-hardened) /proc mount, and precise timing against a transient process - no public exploit identified at time of analysis, and no evidence of active exploitation.
Local information disclosure in the wsl-pro-service component of Ubuntu Pro for WSL (versions before 0.1.19ubuntu3) lets any unprivileged user or process sharing a WSL instance read the Ubuntu Pro attach token while the root-run service executes `pro attach <token> --format=json`; the token sits in cleartext in /proc/<pid>/cmdline, which remains world-readable in WSL because /proc is mounted without hidepid. Because the token is a bearer credential for the subscription, an attacker who wins the short race window can attach their own machines to the victim's Ubuntu Pro subscription and consume its entitlements and services. Exploitation requires a pre-existing local account inside the WSL instance, the WSL-default (non-hardened) /proc mount, and precise timing against a transient process - no public exploit identified at time of analysis, and no evidence of active exploitation.