A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade python3-abrtUpgrade abrt-addon-ccppUpgrade abrt-python-docUpgrade abrt-pythonUpgrade python3-abrt-container-addonUpgrade abrt-gui-libsUpgrade abrt-addon-pstoreoopsUpgrade abrt-cliUpgrade abrt-addon-kerneloopsUpgrade abrt-tui-debuginfoUpgrade abrt-addon-vmcoreUpgrade python3-abrt-docUpgrade python3-abrt-addonUpgrade abrt-addon-pythonUpgrade abrt-addon-upload-watch-debuginfoUpgrade abrt-addon-coredump-helper-debuginfoUpgrade abrt-addon-ccpp-debuginfoUpgrade abrt-dbusUpgrade abrt-guiUpgrade abrt-cli-ngUpgrade abrt-libsUpgrade abrt-plugin-machine-idUpgrade abrt-addon-coredump-helperUpgrade abrt-debuginfoUpgrade abrt-desktopUpgrade abrt-develUpgrade abrtUpgrade abrt-gui-libs-debuginfoUpgrade abrt-tuiUpgrade abrt-plugin-sosreportUpgrade abrt-console-notificationUpgrade abrt-gui-debuginfoUpgrade abrt-gui-develUpgrade abrt-retrace-clientUpgrade abrt-addon-kerneloops-debuginfoUpgrade python3-abrt-debuginfoUpgrade abrt-retrace-client-debuginfoUpgrade abrt-debugsourceUpgrade abrt-addon-upload-watchUpgrade abrt-dbus-debuginfoUpgrade abrt-addon-pstoreoops-debuginfoUpgrade abrt-atomic-debuginfoUpgrade abrt-libs-debuginfoUpgrade abrt-addon-xorg-debuginfoUpgrade abrt-addon-xorgNo solution exists | Jul 17, 2026 | May 4, 2026 |
| Rocky_linux | — | Upgrade python3-abrt-debuginfoUpgrade abrt-addon-pstoreoopsUpgrade abrt-guiUpgrade abrt-gui-libsUpgrade abrt-debugsourceUpgrade abrt-cliUpgrade abrt-addon-coredump-helperUpgrade abrt-addon-coredump-helper-debuginfoUpgrade abrt-addon-ccppUpgrade abrt-addon-kerneloopsUpgrade python3-abrt-container-addonUpgrade abrt-dbusUpgrade abrt-plugin-machine-idUpgrade abrtUpgrade abrt-dbus-debuginfoUpgrade python3-abrtUpgrade abrt-cli-ngUpgrade abrt-console-notificationUpgrade abrt-addon-vmcoreUpgrade abrt-addon-xorg-debuginfoUpgrade abrt-gui-debuginfoUpgrade abrt-desktopUpgrade abrt-addon-ccpp-debuginfoUpgrade abrt-addon-pstoreoops-debuginfoUpgrade abrt-tui-debuginfoUpgrade abrt-libsUpgrade abrt-addon-xorgUpgrade abrt-gui-libs-debuginfoUpgrade python3-abrt-addonUpgrade abrt-tuiUpgrade abrt-plugin-sosreportUpgrade abrt-libs-debuginfoUpgrade abrt-debuginfoUpgrade abrt-addon-kerneloops-debuginfo | Aug 14, 2026 | Aug 13, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub