Bug 2552065 (CVE-2026-110330)

Summary: CVE-2026-110330 abrt: abrt: abrt-server trusts client-supplied PID= allowing unprivileged read of other processes' /proc environ
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This allows a local attacker to read environment variables and related metadata of other users' or root processes when abrtd is running.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-11-17   

Description OSIDB Bzimport 2026-10-14 03:41:43 UTC 
A flaw was found in abrt. The abrt-server helper, spawned as root for connections to the world-writable abrt.socket, accepts a client-supplied PID= value and uses it to harvest /proc/<pid> data (including environ) into a problem dump owned by the connecting user's uid from SO_PEERCRED, without verifying that the target process belongs to that user. A local unprivileged attacker can thereby obtain environment variables and related process metadata of other users' or root processes when abrtd is running.