Red Hat / Oracle Linux ABRT Local Privilege Escalation Vulnerability (CVE-2015-5287) Analysis and Mitigation Guide

1. Package Upgrade (Recommended)

Update the ABRT packages to the latest version using the system package manager.

Red Hat Enterprise Linux / CentOS / Oracle Linux:

# Update ABRT packages
sudo yum update abrt abrt-addon-ccpp

# Restart the services
sudo systemctl restart abrtd
sudo systemctl restart abrt-ccpp

2. Temporary Mitigation (If patching is not immediately possible)

Disable the vulnerable core dump helper service (abrt-ccpp) to block the attack vector.

# Stop and disable abrt-ccpp service
sudo systemctl stop abrt-ccpp
sudo systemctl disable abrt-ccpp

# Restore default core dump handler via sysctl (if necessary)
sudo sysctl -w kernel.core_pattern=core

This vulnerability (CVE-2015-5287) is a Local Privilege Escalation (LPE) vulnerability in the abrt-hook-ccpp helper program of the Automatic Bug Reporting Tool (ABRT).

Root Cause (CWE-59)

abrt-hook-ccpp runs with elevated privileges (root) to handle system core dumps. During this process, it creates temporary files in directories like /var/tmp/abrt/ or /var/spool/abrt/ using predictable filenames.

Exploit Mechanics

• A local attacker creates a symbolic link at a predictable path (e.g., /var/tmp/abrt/abrt-hax-coredump) pointing to a critical system file (such as /etc/ld.so.preload or other system configuration files).
• The attacker triggers a crash to invoke the abrt-hook-ccpp helper.
• Running as root, ABRT follows the symbolic link without proper validation, writing data to or modifying the permissions of the target file, allowing the attacker to execute arbitrary code with root privileges.

This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, indicating active exploitation in the wild. Immediate remediation is highly recommended.