Executive brief
A vulnerability in the Automatic Bug Reporting Tool (ABRT) allows a local user to inject fake data into system crash reports. ABRT is used to collect and analyze information when software fails. By manipulating system logs, an attacker can force the system to write unauthorized content into administrative dump directories, potentially misleading administrators or corrupting diagnostic data.
Technical details
A content injection vulnerability exists in the ABRT post-create event handler scripts within libreport. The scripts use journalctl to query systemd journal entries for crashed processes and write the output to files in the dump directory (e.g., var_log_messages) without sanitizing control characters. A local attacker can use prctl(PR_SET_NAME) to match a target process name and syslog() to inject messages containing newline characters. Because the script does not sanitize these embedded characters, the attacker can control the content written by the root user to files in the dump directory. This bypasses intended logging integrity and allows for the insertion of arbitrary data into administrative report files.
Affected products
- Red Hat libreport
- Red Hat ABRT (Automatic Bug Reporting Tool)
Timeline
- 2026-06-13: disclosed: NVD publication date
- 2026-06-12: advisory: Red Hat bugzilla entry created