Bug 2488532 (CVE-2026-54229)

Summary: CVE-2026-54229 abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2488617    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-12 20:58:13 UTC 
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY (which does not require a write lock) and calls dd_chown to change ownership of all files to the caller's uid. This succeeds even while post-create event handlers hold a write lock on the dump directory, because the read-only open does not conflict with the write lock. After ChownProblemDir, the attacker gains direct filesystem-level access to the dump directory (can delete files, create symlinks, etc.) while the already-running event shell process continues executing with root privileges in the abrt_handle_event_t SELinux domain.