CVE-2026-54229: Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking

Synopsis

A race condition in the abrt-dbus service's ChownProblemDir method allows a local attacker to hijack a crash dump directory on Red Hat Enterprise Linux 6, 7, and 8. The flaw is reachable locally with a low-privilege account and requires no victim interaction, though exploiting it depends on winning a timing race while post-create event handlers hold a write lock. Successful exploitation gives the attacker filesystem-level ownership of the dump directory while privileged scripts are still operating, enabling full read, write, and denial-of-service impact against its contents. HarborGuard is tracking the upstream advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; the vulnerable ChownProblemDir D-Bus method is accessible only to local users.

• AuthenticationRequired

  A low-privilege local account is sufficient; no administrative or root credentials are needed to invoke the D-Bus method.

• Victim interactionNot required

  No user interaction of any kind is required; the attacker triggers the race condition entirely through their own D-Bus calls.

• Attack complexityDetail

  Exploitation depends on winning a timing race against post-create event handlers holding a write lock, introducing environmental factors that make reliable triggering non-trivial.

Blast Radius

• Reads all files in the crash dump directory, including core dumps and environment data that may contain secrets or credentials from the crashed process.
• Overwrites or replaces files in the dump directory while privileged post-create scripts are still executing against them, enabling content tampering.
• Interferes with privileged event handler execution by manipulating dump directory contents mid-run, potentially causing those scripts to act on attacker-controlled data.
• Denial of service against the crash reporting pipeline by corrupting dump directories, preventing legitimate crash data from being collected or analyzed.