CVE-2015-5287: ABRT abrt-hook-ccpp symlink privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityLocal privilege escalation to full host compromise with public exploit code and CISA KEV listing, though it requires an existing local account.

What it is

The abrt-hook-ccpp helper in Red Hat's Automatic Bug Reporting Tool (ABRT) before 2.7.1 follows symlinks on files with predictable names, letting a local user with certain permissions write to attacker-chosen paths. Because the helper runs with elevated privileges, this link-following flaw becomes a local privilege escalation.

Impact

An attacker gains elevated privileges on the host, with high impact to confidentiality, integrity and availability per the CVSS vector. This is a full local root-level compromise of the affected system.

Attack surface

Reached locally: the vector is AV:L/PR:L/UI:N, so the attacker needs a local account with low privileges and no user interaction. No network or remote vector is described.

Exploitation

CISA added it to KEV with a due date of 2026-09-09, and multiple references are tagged Exploit, so public exploit code exists. EPSS is 0.04962 (91.7th percentile), indicating elevated but not top-tier predicted activity.

What to do

• Patch ABRT to 2.7.1 or later, or apply the vendor errata RHSA-2015-2505 for Red Hat Enterprise Linux.
• If patching is not immediately possible, restrict or disable the ABRT coredump hook and limit local shell access to trusted users.
• Harden the predictable paths named in the advisory (/var/tmp/abrt and /var/spool/abrt) so unprivileged users cannot create or replace entries there.
• Track the CISA KEV due date of 2026-09-09 and confirm remediation across all affected Red Hat and Oracle Linux assets.

Detection

• Monitor for symlinks or unexpected files created in /var/tmp/abrt and /var/spool/abrt, especially names resembling abrt-hax-coredump.
• Alert on abrt-hook-ccpp or sosreport processes writing outside expected coredump paths or spawning shells.
• Audit local account activity preceding privilege changes, correlating coredump events with new root sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.