EUVD-2026-36638
GHSA-c3cq-8jxp-w66j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv local shell on RHEL host
-
DeliveryTrigger or await crash creating problem dir
-
ExploitRace abrt-dbus ChownProblemDir against post-create handlers
-
ExecutionWin DD_OPEN_READONLY chown while write-lock held
-
PersistTake ownership of files written by privileged scripts
-
ImpactTamper with privileged output for escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated local account on a RHEL 6, 7, or 8 host with the abrt-dbus service installed and running and reachable on the system D-Bus, plus the ability to invoke the ChownProblemDir method on an existing problem directory while abrt post-create event handlers are still executing against that same directory. Exploitation is limited by AC:H - the attacker must reliably hit the narrow window during which a post-create handler holds the write lock - and by PR:L (any local user, but not remote/network), and is further constrained to hosts where ABRT is actually enabled (it is default on these RHEL releases but commonly disabled on hardened servers). |
| Impact | The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H correctly reflects this as a local, low-privileged but high-complexity race with full CIA impact on the abrt subsystem and any data those event scripts touch. AC:H is appropriate because the attacker must reliably win a race against a transient post-create handler window, which limits drive-by mass exploitation but is well within reach of a motivated local user with scripted retries. EPSS data was not provided in the input, the vulnerability is not on the CISA KEV list, and no public PoC is referenced - the available references are only the Red Hat CVE page and Bugzilla 2488532, both of which appear undated in the input. Net assessment: a meaningful local privilege/data-integrity issue on multi-user RHEL systems (especially shared bastions, build hosts, and CI runners) but not an internet-facing emergency; prioritize behind any unauthenticated remote findings. |
| Exploit ScenarioDerived | A low-privileged shell user on a RHEL 6/7/8 host triggers a crash (or waits for one) and, in a tight loop, calls the abrt-dbus ChownProblemDir method on the new problem directory while the privileged post-create handlers (e.g. analyze/collect scripts running as the abrt user or root) are still writing into it. Winning the race hands the user ownership of files that root-context scripts are still producing, allowing the attacker to replace or modify those files and influence privileged output, potentially escalating impact when downstream tooling reads them as trusted. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 13, 2026
Local privilege escalation in the abrt-dbus D-Bus service on Red Hat Enterprise Linux 6, 7, and 8 allows a low-privileged local user to race the ChownProblemDir method against still-running post-create event handlers. By invoking ChownProblemDir while privileged event scripts hold a write lock on the dump directory, the attacker gains filesystem ownership of files being written by root-context handlers, enabling tampering with privileged output and potential privilege escalation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis from the provided input - track https://access.redhat.com/security/cve/CVE-2026-54229 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2488532 for the fixed abrt package versions for RHEL 6, 7, and 8 and apply them via yum/dnf once published. As a compensating control until a patch is available, restrict who can talk to the abrt-dbus service by tightening the org.freedesktop.problems / com.redhat.problems D-Bus policy in /etc/dbus-1/system.d/ to administrators only (this will break end-user retrieval of their own crash reports), or stop and mask the abrtd / abrt-dbus services with systemctl mask abrt-dbus.service abrtd.service on hosts where automated crash reporting is non-essential (side effect: no crash collection for support cases). On shared multi-user systems also consider disabling abrt post-create event scripts in /etc/libreport/events.d/ to shrink the race window, accepting reduced crash-handling automation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ABRT (Automatic Bug Reporting Tool) exposes a system-level D-Bus interface (abrt-dbus) used to manage crash dump directories under /var/spool/abrt or /var/tmp/abrt. The ChownProblemDir method is intended to transfer ownership of a problem directory to the requesting user so they can read their own crash data, and it opens the dump directory with the DD_OPEN_READONLY flag before calling dd_chown to recursively chown all files. The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e. a race condition): DD_OPEN_READONLY bypasses the directory's write-lock protocol, so the chown succeeds even while a separate privileged post-create event handler still holds the write lock and is producing files in the same directory. The result is a TOCTOU/locking gap between the privileged event pipeline and the unprivileged user that the dump is later handed to.
Know when Red Hat Enterprise Linux 6 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local D-Bus call (AV:L) by any logged-in user (PR:L), no UI, success requires winning a narrow lock race (AC:H), yielding ownership-level control over privileged dump files (C/I/A:H).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.
Executive ViewAI
The abrt-dbus service in Red Hat Enterprise Linux 6, 7, and 8 is vulnerable to local privilege escalation through a race condition in the ChownProblemDir D-Bus method, allowing low-privileged users to gain root ownership of system files and modify privileged output. Organizations running these RHEL versions with local user access face direct risk of system file tampering and unauthorized privilege escalation. No vendor patch is currently available, necessitating immediate interim controls.
Disable abrt-dbus D-Bus service where operationally feasible; implement D-Bus access control policies restricting the ChownProblemDir method to trusted processes only; restrict local user account creation and shell access on production systems; deploy file integrity monitoring (FIM) on system directories where abrt operates; enable D-Bus audit logging to detect unusual ChownProblemDir invocations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Affected Products (CPE)CVE.org
Related Vulnerabilities in abrt-dbus D-Bus Service Race Condition Flaws
View all 2More in Red Hat Enterprise Linux 6
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
Exploit-DB