CVE-2015-1862: Race Condition
A local privilege escalation flaw was found in abrt, in the way certain core-handlers were specified by the abrt application.
Specifically this issue affects those abrt versions in which the following core-handler was used: HOOKBIN="/usr/sbin/chroot /proc/%P/root @libexecdir@/abrt-hook-ccpp"
This commit was added to abrt via: (To add support for handling crashes inside containers) https://github.com/abrt/abrt/commit/4ab9fbe1a6b7889a0cd59b1406e8789d52171fd2 https://github.com/abrt/abrt/issues/809
But later removed via: https://github.com/abrt/abrt/commit/cdb507ed336fa30151eefa6510d20c9271e7fc82
No version of Red Hat Enterprise Linux or Fedora ships abrt with the above vulnerable code.
Support for containers was re-added in abrt (using a different method this time) via: https://github.com/abrt/abrt/commit/a6cdfd6a16251447264d203e145624a96fa811e3
Other sources
The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1862?
The severity of CVE-2015-1862 is rated as high with a severity score of 7.
How do I fix CVE-2015-1862?
To fix CVE-2015-1862, update Abrt to version 2.2.1 or later.
What software is affected by CVE-2015-1862?
CVE-2015-1862 affects Abrt versions up to and including 2.2.0.
What type of vulnerability is CVE-2015-1862?
CVE-2015-1862 is a privilege escalation vulnerability.
What is the exploit method for CVE-2015-1862?
CVE-2015-1862 can be exploited by local users leveraging an execve by root after a chroot into a user-specified directory in a namespaced environment.