Executive brief
A security vulnerability exists in the Automatic Bug Reporting Tool (ABRT), a system used to detect and analyze software crashes. A local attacker can trick the system into overwriting critical system files by replacing temporary crash report files with symbolic links. This could allow an attacker to gain elevated privileges or cause a complete system failure by corrupting essential configuration files.
Technical details
A symlink following vulnerability (CWE-59) exists in the ABRT post-create event handler scripts within libreport, specifically in /etc/libreport/events.d/abrt_event.conf. The vulnerability is rooted in the use of shell redirections (e.g., '>' or '>>') which perform file operations without the O_NOFOLLOW flag. Because these scripts are executed by a shell process running as root (within the abrt_handle_event_t SELinux domain), they will follow symbolic links to their targets. An attacker with filesystem control over the dump directory can replace expected output files with symlinks to sensitive locations like /var/spool/cron/root, leading to arbitrary file overwrites and potential privilege escalation. This requires the attacker to have local access and the ability to manipulate files in the dump directory before the event handler executes.
Affected products
- Red Hat libreport
- Red Hat ABRT (Automatic Bug Reporting Tool)
Timeline
- 2026-06-12: disclosed: Reported via Red Hat Bugzilla
- 2026-06-13: advisory: NVD publication date