CVE-2025-12744: Abrt: command-injection in abrt leading to local privilege escalation
A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.
Other sources
Command-injection vulnerability in ABRT’s container data handling. The flaw is caused by ABRT extracting a 12-byte substring from user-controlled mount information and embedding it verbatim into a shell command constructed with gstrdupprintf("docker inspect %s", containerid). Because the input is not sanitized and is passed to a shell invocation, a crafted mountinfo value can inject shell metacharacters and arbitrary commands. This can be exploited locally by any user with access to ABRT’s UNIX socket to escalate to root and escape systemd sandboxing, enabling full system compromise.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12744?
CVE-2025-12744 has been classified as a medium severity vulnerability.
How do I fix CVE-2025-12744?
To fix CVE-2025-12744, ensure that you update to the latest version of Red Hat ABRT that addresses this vulnerability.
Who is affected by CVE-2025-12744?
CVE-2025-12744 affects unprivileged local users of the Red Hat ABRT daemon.
What is the risk associated with CVE-2025-12744?
The risk associated with CVE-2025-12744 is that an unprivileged local user can execute arbitrary shell commands via crafted input.
When was CVE-2025-12744 disclosed?
CVE-2025-12744 was disclosed in 2025.