Bug 2412467 (CVE-2025-12744)
| Summary: | CVE-2025-12744 abrt: Command-injection in ABRT leading to local privilege escalation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2418567, 2418568, 2418569 | ||
| Bug Blocks: | |||
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:22760 https://access.redhat.com/errata/RHSA-2025:22760 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2025:23030 https://access.redhat.com/errata/RHSA-2025:23030 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2025:23031 https://access.redhat.com/errata/RHSA-2025:23031 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2025:23033 https://access.redhat.com/errata/RHSA-2025:23033 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2025:23032 https://access.redhat.com/errata/RHSA-2025:23032 |
Command-injection vulnerability in ABRT’s container data handling. The flaw is caused by ABRT extracting a 12-byte substring from user-controlled mount information and embedding it verbatim into a shell command constructed with g_strdup_printf("docker inspect %s", container_id). Because the input is not sanitized and is passed to a shell invocation, a crafted mountinfo value can inject shell metacharacters and arbitrary commands. This can be exploited locally by any user with access to ABRT’s UNIX socket to escalate to root and escape systemd sandboxing, enabling full system compromise.