Listen to this Post
The Automatic Bug Reporting Tool (ABRT) is a system service designed to automatically detect, collect, and report application crashes on Red Hat-based Linux distributions. Prior to version 2.7.1, ABRT contained a critical security flaw in the `abrt-action-install-debuginfo-to-abrt-cache` helper program that allowed local attackers to escalate privileges.
The vulnerability stems from insecure handling of temporary directories. When the debug information installer runs, it creates temporary directories with predictable names in `/var/tmp` and processes `unpacked.cpio` archives without proper validation. The `xopen3()` function call used by ABRT does not include the `O_NOFOLLOW` flag, making it susceptible to symlink attacks.
An attacker with local access and minimal privileges can exploit this by pre-creating a directory with a predictable name and placing a malicious symbolic link inside. When ABRT processes the directory, it follows the symlink and writes files to arbitrary locations on the system as the `abrt` user. While the initial write occurs as the `abrt` user, this can be combined with another flaw (CVE-2015-5287) in `abrt-hook-ccpp` to achieve full root privileges.
The `abrt-hook-ccpp` component handles core dumps when applications crash. When a process receives SIGSEGV, ABRT saves diagnostic information in /var/tmp/abrt/ccpp-$pid. Unless `PrivateReports = yes` is set in /etc/abrt/abrt.conf, directories created here are chown()‘d to the user who owned the crashing process. The post-create script `/usr/sbin/sosreport` is then invoked as root and works with a temporary directory in the same location. Since the attacker owns the parent directory, they can rename it and create a crafted replacement, causing `sosreport` to follow symlinks and write arbitrary files as root.
This vulnerability affects RHEL 7 and 7.1 by default, while RHEL 6 systems are only vulnerable if `PrivateReports` is disabled. CentOS 7 and Fedora 22 are also confirmed vulnerable. The exploit chain allows a local unprivileged user to gain full root access on a default installation.
DailyCVE Form:
Platform: RHEL/CentOS/Fedora
Version: ABRT < 2.7.1
Vulnerability: Insecure temp directory
Severity: Medium (CVSS 3.6)
date: 2015-12-01
Prediction: Patch released 2015-11-23
What Undercode Say:
Check ABRT version rpm -q abrt Check vulnerable systems cat /etc/redhat-release Check if PrivateReports is enabled grep PrivateReports /etc/abrt/abrt.conf Check for ABRT dump directory permissions ls -la /var/spool/abrt/ ls -la /var/tmp/abrt/
Exploit: (Educational Purposes!)
The following steps demonstrate the privilege escalation chain:
!/usr/bin/python CVE-2015-5273 + CVE-2015-5287 CENTOS 7.1/Fedora22 local root import time,os,datetime,sys,resource,socket Step 1: Create directory structure with symlinks mkdir dir1 ln -s /var/spool/abrt dir1/hax mkdir dir2 mkdir dir2/hax ln -s /proc/sys/kernel/modprobe dir2/hax/abrt-hax-coredump Step 2: Create cpio archives cd dir1 find . -depth -print | cpio -o > ../cpio1 cd ../dir2 find . -depth -print | cpio -o > ../cpio2
The exploit creates a symlink from a predictable file path to /proc/sys/kernel/modprobe. When ABRT processes a crash, it follows the symlink and overwrites the `modprobe` binary path with attacker-controlled data. Upon successful exploitation, the attacker gains a root shell.
Protection:
- Update ABRT to version 2.7.1 or later
- Apply Red Hat Security Advisory RHSA-2015:2505
- Enable `PrivateReports = yes` in `/etc/abrt/abrt.conf`
– Restrict local user access on multi-user systems - Monitor `/var/spool/abrt/` and `/var/tmp/abrt/` for suspicious symlink creation
Impact:
- Privilege Escalation: Local unprivileged users can gain root access
- System Compromise: Full control over the affected system
- Data Integrity: Arbitrary file writes as the `abrt` user and root
- Affected Distributions: RHEL 7/7.1, CentOS 7.1, Fedora 22
- Exploit Availability: Public exploits exist in the wild
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
