A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY (which does not require a write lock) and calls dd_chown to change ownership of all files to the caller's uid. This succeeds even while post-create event handlers hold a write lock on the dump directory, because the read-only open does not conflict with the write lock. After ChownProblemDir, the attacker gains direct filesystem-level access to the dump directory (can delete files, create symlinks, etc.) while the already-running event shell process continues executing with root privileges in the abrt_handle_event_t SELinux domain.