CVE-2015-5287

What is ABRT?

The Automatic Bug Reporting Tool (ABRT) is Red Hat's crash-collection framework, shipped by default on Red Hat Enterprise Linux, Fedora, and CentOS. When an application crashes, ABRT's kernel core-dump hook (abrt-hook-ccpp) and its helper daemons capture the core dump, associated files, and metadata into a per-crash directory under /var/spool/abrt (or /var/tmp/abrt) for later reporting. Because these components run as root and operate on paths and files that unprivileged users can influence, ABRT has historically been a rich source of local privilege-escalation bugs.

Overview

CVE-2015-5287 is a privilege-escalation flaw in ABRT disclosed as part of a broader set of ABRT/libreport local-root vulnerabilities. A local user with limited privileges can exploit a symlink / time-of-check-to-time-of-use (TOCTOU) weakness in how ABRT handles crash-dump files with predictable names, causing root-owned operations to follow an attacker-controlled symlink and write or manipulate files outside the intended crash directory. This allows the attacker to gain root privileges on the affected host.

Affected Versions

Products at end-of-life (EoL) or end-of-service (EoS) will not receive a fix; discontinue use and migrate to a supported release.

Technical Details

The vulnerability is a link-following issue (CWE-59). ABRT creates and operates on files with predictable names in a directory writable by, or influenceable by, unprivileged users. An attacker pre-creates a symbolic link at the predicted path pointing to a sensitive root-owned file; when a root-privileged ABRT component subsequently opens or writes that path, it follows the symlink and performs the privileged operation on the attacker's chosen target. The low attack complexity (AC:L) reflects that the file names are predictable and the race window is practically exploitable, with public exploit code demonstrating reliable local root.

Discovery

The ABRT/libreport local-root vulnerabilities, including CVE-2015-5287, were researched and disclosed by the Qualys Security Advisory team, published to the oss-security mailing list on 1 December 2015 with proof-of-concept exploit code.

Exploitation Context

Public proof-of-concept exploits for the 2015 ABRT vulnerability cluster have circulated for years and are readily available. CISA's KEV addition in August 2026 signals confirmed exploitation against unpatched, often end-of-life RHEL 7 / CentOS 7 systems where the vulnerable abrt package is still installed and enabled. As a local-privilege-escalation bug, it is used after initial access to move from an unprivileged shell to root.

Remediation

1. Update the abrt package to the fixed version (yum update abrt) — RHEL 7 users should install abrt-2.1.11-31.el7_1 or later.
2. For EoL/EoS systems, migrate to a supported distribution; no patch exists for unsupported releases.
3. Consider disabling ABRT (systemctl disable --now abrtd abrt-ccpp) on servers that do not need automated crash reporting, reducing the local attack surface.
4. Restrict local shell access and audit account membership, since exploitation requires a local login.
5. Review /var/spool/abrt and /var/tmp/abrt for suspicious symlinks and inspect for local privilege-escalation indicators such as unexpected setuid files or root shells.