EUVD-2026-36637
GHSA-6pjg-wmm6-r8rp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local shell on RHEL host
-
DeliveryTrigger crash to create dump directory
-
ExploitRace SetElement against post-create handler
-
ExecutionWrite attacker-controlled files into root-owned dump dir
-
PersistBypass package validation for unpackaged crash
-
ImpactLeverage planted files for further privileged abuse
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Exploitation requires an interactive local session on a RHEL 6/7/8 host where the abrt-dbus service is running and reachable on the system bus, and the attacker must be able to invoke the SetElement method on org.freedesktop.problems and trigger or observe a fresh crash dump directory in order to race it. Limiting factors: AV:L means no remote vector, PR:L requires an existing local account, the attacker must reliably win a TOCTOU window between dump-directory creation and post-create event execution (which typically demands many attempts and tight timing), and the primitive described is constrained to writing text files and bypassing package validation rather than arbitrary binary execution. Hosts where abrtd/abrt-dbus is masked or where SetElement is restricted by polkit are not exposed. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N with H/H/H impacts yields a 7.8 score, which is consistent with a local user gaining the ability to plant root-owned files and influence a root-context post-create flow. There is no EPSS, KEV, or SSVC data in the provided intelligence, and no public exploit identified at time of analysis, so the practical exploitation pressure today appears moderate rather than urgent. The most important caveat is scope: the description constrains the impact to writing arbitrary text files and bypassing package validation, which does not by itself prove full code execution as root - the H/H/H impacts feel high relative to the described primitive, and defenders should treat full RCE as plausible-but-unconfirmed until Red Hat's advisory clarifies the downstream consequences. The CPE list flags RHEL 6/7/8, but RHEL 6 and 7 are out of standard maintenance, which materially limits patch availability for many real deployments. |
| Exploit ScenarioDerived | A local unprivileged user with shell access (for example, a low-trust developer on a shared RHEL build host, or an attacker who has already gained a foothold via a web app) triggers a crash to create a dump directory, then races abrt-dbus by repeatedly calling SetElement against the new directory before the post-create handler runs. Winning the race lets them deposit attacker-controlled text files into the root-owned dump directory and preserve crash records for unpackaged binaries that the post-create policy would normally discard, providing a foothold for further abuse of any tooling that later trusts those files. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 13, 2026
Local privilege escalation in the abrt-dbus D-Bus service on Red Hat Enterprise Linux 6, 7, and 8 allows any unprivileged local user to win a TOCTOU race against the SetElement method, writing arbitrary text files into root-owned dump directories. By exploiting the gap between dump directory creation and post-create event execution, an attacker bypasses package validation and persists crash data for unpackaged binaries inside privileged paths, with no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch version is identified at time of analysis in the supplied data, so monitor https://access.redhat.com/security/cve/CVE-2026-54228 and Bugzilla 2488531 and apply the abrt/abrt-dbus errata for each RHEL stream as soon as Red Hat publishes them, prioritizing RHEL 8 where standard maintenance still applies and using Extended Lifecycle Support channels for RHEL 6/7 if available. As compensating controls until patches land, stop and mask the abrt-dbus service (systemctl mask abrtd abrt-dbus) on systems that do not actively rely on automatic crash reporting, accepting that local crashes will no longer be collected for support cases; alternatively, restrict the org.freedesktop.problems D-Bus interface via a polkit/D-Bus policy that limits SetElement to administrators, which preserves crash collection for privileged users but breaks user-space crash uploads. Avoid generic hardening alone - the race is in privileged code, so SELinux in enforcing mode and tight /var/spool/abrt permissions reduce but do not eliminate exposure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
abrt (Automatic Bug Reporting Tool) exposes a D-Bus interface that lets local users submit crash data; the SetElement method writes named elements into a per-crash dump directory owned by root. The flaw is a classic CWE-367 Time-of-Check Time-of-Use race: abrt-dbus validates the dump directory state at creation, but a concurrent SetElement call from a local user can mutate the directory contents before the post-create event handler runs its package-ownership and policy checks. Because abrt's post-create hooks normally discard crashes from unpackaged binaries, winning the race lets attacker-controlled text files survive into a root-owned directory that would otherwise be cleaned up, undermining a security control the rest of the abrt pipeline relies on.
Know when Red Hat Enterprise Linux 6 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user racing a TOCTOU window justifies AV:L/AC:H/PR:L; primitive is root-owned file write so I:H, with limited confidentiality and availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.
Executive ViewAI
A local privilege escalation in abrt-dbus (RHEL 6, 7, 8) allows any unprivileged system user to bypass privilege restrictions and write arbitrary files to root-owned directories, establishing persistent compromise vectors without administrative credentials. No public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Disable abrt-dbus service where operationally feasible. Implement restrictive file-system access controls on crash-dump directories (/var/spool/abrt*). Deploy file-integrity monitoring on privileged system paths. Audit and minimize local user account provisioning on affected systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Related Vulnerabilities in abrt-dbus D-Bus Service Race Condition Flaws
View all 2More in Red Hat Enterprise Linux 6
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
Exploit-DB