ABRT: symlink attack on predictable core-dump paths gives local users root on RHEL hosts

CVE-2015-5287Kernel, userspace & hypervisorKnown exploitedcurated

Impact

The abrt-hook-ccpp helper writes core dumps to predictable paths such as /var/tmp/abrt/abrt-hax-coredump, letting a local user with certain permissions win a symlink race and have a root-privileged component write where they choose - a local root escalation. On a shared login or head node in front of a GPU cluster, where users legitimately hold interactive shells, that converts an ordinary account into host root with access to every other tenant's data and to the GPU devices. This is a 2015 bug in RHEL 6/7-era packages and modern images are not affected, but it stays on CISA's exploited list and long-lived login nodes and old base images are exactly where an unpatched abrt survives.

Who can reach it

Local user with a shell on the host and the ability to trigger a core dump. Requires an ordinary account; not reachable over the network.

What to do

Update ABRT to 2.7.1 or later, or take the vendor package set in RHSA-2015-2505. abrt-hook-ccpp is invoked per crash rather than running continuously, so the fixed binary applies to the next dump; restarting abrtd is enough and no reboot is needed. On nodes that do not need crash reporting at all, pointing kernel.core_pattern away from abrt-hook-ccpp removes the exposure without touching packages.

References

https://nvd.nist.gov/vuln/detail/CVE-2015-5287 http://rhn.redhat.com/errata/RHSA-2015-2505.html http://www.openwall.com/lists/oss-security/2015/12/01/1 http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.