Executive Summary

This vulnerability is a race condition in the abrt-dbus D-Bus service's ChownProblemDir method. The method opens the dump directory in read-only mode and attempts to change ownership of all files to the caller's user ID. Because it uses a read-only open that does not conflict with existing write locks held by post-create event handlers, an attacker can exploit this timing issue to gain filesystem-level control of the dump directory while privileged event scripts are still running.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with limited privileges to gain control over files in the dump directory even while privileged event scripts are executing. This can lead to unauthorized modification or replacement of files, potentially allowing privilege escalation or interference with system diagnostics and recovery processes.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a race condition in the abrt-dbus D-Bus service's ChownProblemDir method, which affects file ownership changes in the dump directory. Detection would involve monitoring the abrt-dbus service behavior and checking for unexpected ownership changes in the dump directory files.

You can check for suspicious ownership changes in the dump directory by running commands like:

• ls -l /var/spool/abrt/ (or the relevant dump directory) to list file ownership and permissions.
• auditctl -w /var/spool/abrt/ -p wa -k abrt_watch to monitor write and attribute changes in the dump directory.
• journalctl -u abrt-dbus.service to review logs related to the abrt-dbus service for unusual activity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the abrt-dbus service and the dump directory to trusted users only, and monitoring for suspicious activity.

Applying any available patches or updates from the vendor that address this race condition is critical once they are released.

Additionally, consider temporarily disabling the abrt-dbus service if it is not essential, to prevent exploitation while a fix is pending.

Useful 0 Not Useful 0