Executive Lead & Threat Context

The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with the formal inclusion of CVE-2015-5287, a local privilege escalation flaw within the Automatic Bug Reporting Tool (ABRT) utility across Red Hat Enterprise Linux (RHEL) 7, CentOS 7, Scientific Linux, and Fedora Linux distributions.

ABRT is an automated daemon framework designed to detect application crashes, collect diagnostic core dumps, and format problem reports for systems administrators. Because ABRT operates as a system service executing with root (UID 0) authority to capture crash state from privileged processes, any breakdown in how it manages temporary problem files creates a critical vulnerability. Active attack telemetry indicates that threat actors who establish initial, low-privileged foothold access on enterprise Linux hosts (e.g., via compromised web services or unprivileged container environments) utilize CVE-2015-5287 to bypass operating system security boundaries and obtain persistent, unrestricted root control.

Vulnerability Breakdown: Insecure Directory Creation in abrt-hook-ccpp

The root architectural failure occurs within abrt-hook-ccpp, the core dump handling hook installed in /proc/sys/kernel/core_pattern. When an unprivileged user process terminates abnormally (such as via a SIGSEGV or SIGABRT signal), the Linux kernel invokes abrt-hook-ccpp with root privileges.

To store the crash dump artifacts, ABRT creates a problem directory beneath /var/spool/abrt/. In vulnerable versions: 

// Conceptual flaw in ABRT problem directory creation
int create_problem_dir(const char *path, uid_t uid) {
    // Problem directory created without ensuring safe symlink resolution
    if (mkdir(path, 0750) < 0) {
        if (errno == EEXIST) {
            // Insecure ownership validation on existing directory
            struct stat statbuf;
            stat(path, &statbuf);
            if (statbuf.st_uid == uid) {
                // Insecure write occurs into user-controlled directory structure
                write_dump_files(path);
            }
        }
    }
}

An attacker creates a crafted directory structure inside /var/spool/abrt prior to crashing a process. When abrt-hook-ccpp executes, the attacker leverages a race condition to replace directory paths with symbolic links pointing to sensitive system files. As a result, the root-owned daemon follows the symlink and writes diagnostic output or attacker-controlled crash metadata into arbitrary files across the operating system.

Attack Mechanics: From Low-Privilege Shell to Root

The observed exploitation sequence follows a disciplined post-compromise path:

  1. Preparing Symlink Traps: The adversary creates a temporary problem directory under /var/spool/abrt/ and constructs a symlink pointing to /etc/cron.d/exploit_cron or /etc/ld.so.preload.
  2. Triggering Controlled Crash: The attacker executes a compiled binary that generates a crash signal (kill -SIGSEGV $$). The Linux kernel dispatches the core dump to abrt-hook-ccpp.
  3. Arbitrary File Write Execution: As ABRT writes the process command-line arguments and environment variables into the problem directory, the data writes directly into /etc/cron.d/exploit_cron.
  4. Scheduled Root Payload Execution: Within sixty seconds, the system crond daemon parses the newly created cron file, executing the attacker's payload script with root privileges to grant an interactive root shell or create a new superuser account in /etc/passwd.

Remediation Matrix & Hardening Procedures

Enterprise Linux systems administrators and security teams must execute the following remediation procedures:

1. Package Upgrade via YUM / DNF

Apply the official Red Hat security update (RHSA-2015:2505 or later) across all affected hosts: 

# Check installed version of ABRT packages
rpm -qa | grep abrt

# Update abrt and associated crash reporting utilities
yum update -y abrt abrt-addon-ccpp libreport

2. Disable and Mask ABRT System Services

If automatic crash reporting is not required in production environments (the recommended hardening standard for hardened cloud workloads), disable and mask the daemon: 

# Stop and disable ABRT services
systemctl stop abrtd.service abrt-ccpp.service
systemctl disable abrtd.service abrt-ccpp.service
systemctl mask abrtd.service abrt-ccpp.service

# Reset kernel core pattern to default system handling
sysctl -w kernel.core_pattern=core

3. Enforce Inode Protection with sysctl

Ensure that Linux kernel symlink and hardlink protections are enabled to prevent unprivileged users from creating malicious symlink targets: 

# Enable protected symlinks and hardlinks in /etc/sysctl.conf
fs.protected_symlinks = 1
fs.protected_hardlinks = 1

# Apply sysctl settings immediately
sysctl -p