EUVD-2026-36639
GHSA-gvjc-4rfj-mxxj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv user (AV:L/PR:L); swapping the output file for a symlink requires winning a timing window so AC:H; root file overwrite enables privilege escalation giving C:H/I:H/A:H.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.
AnalysisAI
Local privilege escalation via arbitrary root-owned file overwrite affects libreport's ABRT post-create event handler scripts on Red Hat Enterprise Linux 6, 7, and 8. The event scripts write output using shell redirections that lack the O_NOFOLLOW flag, so a local low-privileged user who plants a symlink in a writable crash-dump path can cause the root shell to follow it and clobber any file on the system, which can be leveraged for full system compromise. SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 5th percentile).
Technical ContextAI
libreport is the reporting library behind ABRT (Automatic Bug Reporting Tool), the default crash-collection and reporting framework on Red Hat and Fedora systems. When a crash is captured, ABRT runs post-create event handler scripts as root to enrich the crash dump directory. These scripts emit data using ordinary POSIX shell output redirection (e.g. '> file'), which opens the destination without O_NOFOLLOW. This is a classic CWE-59 (Link Following / improper link resolution) flaw: because the dump directory is influenced by the unprivileged user whose process crashed, that user can replace an expected output filename with a symlink pointing at a sensitive system file. The privileged shell resolves the symlink and truncates/writes the target. The CPE set scopes exposure to Red Hat Enterprise Linux 6, 7, and 8.
RemediationAI
Apply Red Hat's updated libreport/abrt packages once available for your RHEL 6, 7, or 8 release, tracking the fix through the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-54230) and Bugzilla 2488568 (https://bugzilla.redhat.com/show_bug.cgi?id=2488568); the corrected scripts should open output files with O_NOFOLLOW or otherwise refuse to follow symlinks. No exact fixed package version was provided in the input, so confirm the patched build from the vendor advisory rather than assuming a version. As a compensating control until patched, disable the ABRT processing path or the abrtd service (systemctl disable --now abrtd) so untrusted crash dumps are not processed as root - the trade-off is loss of automatic crash collection and bug reporting. Alternatively, tighten permissions on the crash spool directory (e.g. /var/spool/abrt) and restrict ABRT to trusted users so unprivileged users cannot pre-stage symlinks, accepting reduced crash-reporting coverage for general user processes.
More in Red Hat Enterprise Linux 6
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today