This vulnerability arises because the Ubuntu Pro service component in WSL passes the subscription token as a command-line argument to the pro client during the attach process. Since the default /proc filesystem in WSL does not hide process command lines, unprivileged users can read the token from /proc/<pid>/cmdline while the attach process is running. This exposure allows attackers to steal the token and use it to attach other machines to the victim's Ubuntu Pro subscription, gaining unauthorized access to Ubuntu Pro services. The affected versions are all before 0.1.19ubuntu3, specifically versions >=0.1.1 and less than 0.1.19ubuntu2, 0.1.18~24.04.3, 0.1.18~22.04.2, and 0.1.18~20.04.2.

An unprivileged local user or process within the same WSL instance can obtain the Ubuntu Pro subscription token by reading the command line of the attach process. This token leakage can lead to unauthorized attachment of other machines to the victim's subscription, potentially resulting in unauthorized access to Ubuntu Pro services. The vulnerability requires local access and is limited to systems without process-hiding protections on /proc.

A fix is available in Ubuntu Pro for WSL versions 0.1.19ubuntu3 and later. Users should upgrade to these fixed versions to prevent token leakage. Additionally, enabling process-hiding mitigations such as mounting /proc with hidepid options can reduce exposure by preventing unprivileged users from reading other processes' command lines. Patch status is confirmed by the version information; no vendor advisory content was provided to contradict this.