{"id":"CVE-2026-54229","aliases":["ALSA-2026:54272","EUVD-2026-36638","GHSA-c3cq-8jxp-w66j","RHSA-2026:48819","RHSA-2026:48864","RHSA-2026:48865","RHSA-2026:48866","RHSA-2026:54272","RLSA-2026:54272"],"status":"published","title":"Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking","description":"A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00124,"percentile":0.02153,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-362"],"published":"2026-06-13T02:34:31Z","modified":"2026-11-04T23:17:47Z","affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-addon-ccpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-addon-coredump-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-addon-kerneloops","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-addon-pstoreoops","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-addon-vmcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-addon-xorg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-cli-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-console-notification","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-gui-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-plugin-machine-id","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-plugin-sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"abrt-tui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-abrt-addon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-abrt-container-addon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-26.el8_10.alma.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"abrt-dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-25.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"abrt-dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-25.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"abrt-dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-25.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"abrt-dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-25.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"abrt-dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-25.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"abrt-dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-25.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"abrt-dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-61.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-ccpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-ccpp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-coredump-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-coredump-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-kerneloops","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-kerneloops-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-pstoreoops","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-pstoreoops-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-upload-watch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-vmcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-xorg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-addon-xorg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-atomic-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-cli-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-console-notification","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-dbus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-gui-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-gui-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-gui-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-plugin-machine-id","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-plugin-sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-retrace-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-tui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"abrt-tui-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-abrt-addon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-abrt-container-addon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-abrt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.9-26.el8_10.rocky.0.1"}]}],"bundled":4}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:48819","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48864","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48865","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48866","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54272","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54229","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488532","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54229.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54229","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c3cq-8jxp-w66j"},{"url":"https://access.redhat.com/security/cve/CVE-2026-54228","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54230","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54231","tags":["report"]},{"url":"https://bugzilla.redhat.com/2488531","tags":["report"]},{"url":"https://bugzilla.redhat.com/2488532","tags":["report"]},{"url":"https://bugzilla.redhat.com/2488568","tags":["report"]},{"url":"https://bugzilla.redhat.com/2488571","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-54272.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488531","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48819.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54228","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54228","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54229","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48864.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48865.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48866.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488571","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54272.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54230","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54231","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:54272","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-54229","title":"Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking","description":"A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.","status":"published","published":"2026-06-13T02:34:31.11Z","modified":"2026-11-04T22:50:18.377Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-362","CWE-362"],"updated_at":"2026-11-04T23:40:09.798467Z"}],"euvd":[{"id":"EUVD-2026-36638","description":"A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.","status":"published","published":"2026-06-13T02:34:31Z","modified":"2026-11-04T22:50:18Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T00:47:41.139684Z"}],"ghsa":[{"id":"GHSA-c3cq-8jxp-w66j","title":"A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method....","description":"A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.","status":"published","published":"2026-06-13T03:30:23Z","modified":"2026-08-12T18:32:04Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:10:23.360888Z"}],"nvd":[{"id":"CVE-2026-54229","description":"A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.","status":"published","published":"2026-06-13T03:16:21.587Z","modified":"2026-11-04T23:17:47.303Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-05T01:45:09.958441Z"}],"osv":[{"id":"RHSA-2026:48819","title":"Red Hat Security Advisory: abrt security update","status":"published","published":"2026-08-01T10:11:07Z","modified":"2026-08-13T10:16:21Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48864","title":"Red Hat Security Advisory: abrt security update","status":"published","published":"2026-08-01T10:11:08Z","modified":"2026-08-13T10:16:22Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48865","title":"Red Hat Security Advisory: abrt security update","status":"published","published":"2026-08-01T10:11:09Z","modified":"2026-08-13T10:16:23Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48866","title":"Red Hat Security Advisory: abrt security update","status":"published","published":"2026-08-01T10:11:09Z","modified":"2026-08-13T10:16:24Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:54272","title":"Red Hat Security Advisory: abrt security update","status":"published","published":"2026-08-13T10:17:40Z","modified":"2026-09-21T10:12:38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:54272","title":"Important: abrt security update","description":"The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality. \n\nSecurity Fix(es):\n\n* abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories (CVE-2026-54228)\n\n* abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking (CVE-2026-54229)\n\n* abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites (CVE-2026-54230)\n\n* abrt: unsanitized systemd journal content written to dump directory files enables content injection (CVE-2026-54231)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-13T06:01:18.716807Z","modified":"2026-08-13T06:30:03.144002944Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"ALSA-2026:54272","title":"Important: abrt security update","description":"The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality.   \n\nSecurity Fix(es):  \n\n  * abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories (CVE-2026-54228)\n  * abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking (CVE-2026-54229)\n  * abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites (CVE-2026-54230)\n  * abrt: unsanitized systemd journal content written to dump directory files enables content injection (CVE-2026-54231)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-12T00:00:00Z","modified":"2026-10-29T11:02:28.880607039Z","updated_at":"2026-11-02T15:27:54.753319Z"}]}}