CVE-2026-54229
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. It allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.
Risk Assessment
Risk of gaining filesystem-level control over the dump directory by a local attacker, potentially leading to privilege escalation or data manipulation.
Recommendation
It is recommended to update the abrt package to a version containing a fix for this vulnerability.
Other vulnerabilities in abrt
See all- CVE-2015-5287HighActively exploited
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name.
- CVE-2026-54228High
A TOCTOU race condition was found in the SetElement method of the abrt-dbus D-Bus service. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive.
- CVE-2011-4088High
ABRT might allow attackers to obtain sensitive information from crash reports.
- CVE-2015-1862High
The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
Original NVD description (English source)
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.