ABRT crash-report tool bug lets local users gain privileges

Published August 20, 2026 CVE-2015-5287

ABRT is the crash-reporting tool built into Fedora and Red Hat Enterprise Linux. A local user who already has some access to the machine can trick it into writing to a file it should not touch, gaining higher privileges as a result.

Severity
MediumCVSS 2.0 ยท 6.9
Fix
Fixed in 2.7.1Fix recorded on Aug 26, 2026
Affected versions
before 2.7.1
Weakness
CWE-59Link Following
Exploit likelihood
5.0% in 30 daysEPSS, higher than 92% of known flaws
Affects
ABRT
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 26, 2026
Federal fix deadline
Sep 9, 2026

How it works

  • When a program crashes, ABRT's helper abrt-hook-ccpp saves a crash dump to a fixed, predictable file path under /var/spool/abrt or /var/tmp/abrt.
  • A local user can plant a symlink at that exact path pointing to a different file, so when the privileged helper writes the dump it follows the link and writes to the attacker's chosen target instead.

What to do

Check the installed ABRT version with rpm -q abrt or abrt --version and compare it against 2.7.1. Only local users with existing account access can exploit this, not remote attackers.

Run this in the application environment you want to check:

rpm -q abrt

Update ABRT to version 2.7.1 or later through your distribution's package manager, such as yum update abrt or dnf update abrt, and verify the installed version afterward.

Technical details

CVE-2015-5287 affects Automatic Bug Reporting Tool (ABRT) before version 2.7.1. The abrt-hook-ccpp helper, invoked with elevated privileges by the kernel's core-dump handler whenever a program crashes, writes crash dump files to predictable paths like /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump. Because the path is predictable and not properly checked (CWE-59, improper link resolution), a local user with certain permissions can pre-place a symlink there pointing to another file.

The privileged helper follows that symlink instead of the intended dump file, letting the local user gain elevated privileges. Fixed in ABRT 2.7.1.

Severity breakdown

  • Access vector Local Needs local access to the machine
  • Access complexity Medium Some conditions must be met
  • Authentication None No login required
  • Confidentiality impact Complete Total information disclosure
  • Integrity impact Complete Total loss of data integrity
  • Availability impact Complete Total shutdown of the resource
AV:L/AC:M/Au:N/C:C/I:C/A:C Open in FIRST.org calculator
View Original Source