Description
Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink attack on (1) /var/tmp/abrt/*/maps, (2) /tmp/jvm-*/hs_error.log, (3) /proc/*/exe, (4) /etc/os-release in a chroot, or (5) an unspecified root directory related to librpm.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | abrt +20 | 2.1.11-22.ael7b_1 | RHSA-2015:1083 |
| RHEL 7 | libreport +21 | 2.1.11-23.ael7b_1 | RHSA-2015:1083 |
| RHEL 6 | abrt +12 | 2.0.8-26.el6_6.1 | RHSA-2015:1210 |
| RHEL 6 | libreport +14 | 2.0.9-21.el6_6.1 | RHSA-2015:1210 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | abrt +20 | 2.1.11-22.0.1.el7_1 | ELSA-2015-1083 |
| Oracle Linux 7 | libreport +19 | 2.1.11-23.0.1.el7_1 | ELSA-2015-1083 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
ABRT raceabrt Privilege Escalation
exploit/linux/local/abrt_raceabrt_priv_esc
Exploit-DB 2
- ABRT - 'raceabrt' Privilege Escalation (Metasploit) EDB-44097 · local · Feb 16, 2018 · verified
- Abrt (Fedora 21) - Race Condition EDB-36747 · local · Apr 14, 2015 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2015:1210 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2015:1083 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- ELSA-2015-1083 Important: abrt security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 9, 2015
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1211835
- https://github.com/abrt/abrt/commit/80408e9e24a1c10f85fd969e1853e0f192157f92
- [oss-security] 20150416 Re: Problems in automatic crash analysis frameworks mailing-list
- [oss-security] 20150414 Problems in automatic crash analysis frameworks mailing-list
- RHSA-2015:1083 vendor-advisory
- https://github.com/abrt/abrt/commit/17cb66b13997b0159b4253b3f5722db79f476d68
- https://github.com/abrt/abrt/commit/d6e2f6f128cef4c21cb80941ae674c9842681aa7
- 75117 vdb-entry
- 44097 exploit
- RHSA-2015:1210 vendor-advisory
- https://github.com/abrt/abrt/commit/4f2c1ddd3e3b81d2d5146b883115371f1cada9f9