A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade abrt-addon-vmcoreUpgrade abrt-pythonUpgrade abrt-addon-kerneloopsUpgrade abrt-addon-pythonUpgrade abrt-python-docUpgrade abrt-cliUpgrade abrt-guiUpgrade abrtUpgrade abrt-libsUpgrade abrt-debuginfoUpgrade abrt-dbusUpgrade abrt-develUpgrade abrt-gui-libsUpgrade abrt-desktopUpgrade abrt-addon-pstoreoopsUpgrade abrt-addon-ccppUpgrade abrt-addon-xorgUpgrade abrt-addon-upload-watchUpgrade abrt-gui-develUpgrade abrt-retrace-clientUpgrade abrt-tuiNo solution existsUpgrade abrt-console-notification | Jul 17, 2026 | May 4, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
