On fully updated Fedora 44, a low-privileged local user can spoof a native journald entry that matches `abrt-dump-journal-core` as if it came from `systemd-coredump`. ABRT then trusts attacker-controlled `COREDUMP_FILENAME` and `COREDUMP_UID` fields. The root `abrt-dump-journal-core` service copies the path from `COREDUMP_FILENAME` into a new ABRT problem as the `coredump` element, and `org.freedesktop.Problems2.GetProblemData()` returns that element to the attacker because the attacker also controls the saved `uid` element.

This gives a low-privileged local user a root file disclosure primitive. In the lab, a file owned by `root:root`, mode `0600`, under `/root` was recovered through ABRT by user `fedtest`.

Additional validation showed that the primitive is not limited to extensionless files. ABRT stores files with extensions as `coredump.<extension>`, and those elements are also returned to the attacker. Using this, `fedtest` recovered high-value root-only files including SSH host private keys, cloud-init sensitive instance data, and Azure Linux Agent private material under `/var/lib/waagent`. The recovered files had the same size and SHA-256 hash as the original root-only files.

In an Azure Fedora VM lab, the impact extends beyond generic file disclosure. The low-privileged user recovered `TransportPrivate.pem`, `TransportCert.pem`, and `Certificates.p7m` from `/var/lib/waagent`, then used the recovered transport credential to decrypt `Certificates.p7m` into a PKCS#12 bundle containing a certificate and private key. This demonstrates host and cloud-agent secret compromise from a local unprivileged account.

The lab was originally in SELinux Permissive mode. A follow-up control test temporarily switched SELinux to Enforcing. In Enforcing mode, `/etc/shadow` was blocked by policy, but the Azure Linux Agent private key under `/var/lib/waagent/*.prv` was still recovered with a matching SHA-256 hash because the file is labeled `var_lib_t`. Therefore, the exact set of readable files depends on SELinux type policy, but cloud-agent secret disclosure is confirmed even under Enforcing in this Azure Fedora lab.

Please check the details report and POC at the below link
https://drive.google.com/file/d/11-kQfYS_ZALC94ikoWZ0UQvpgJ0fAv-2/view?usp=sharing

Reproducible: Always