{"id":"CVE-2026-110331","kind":"vulnerability","aliases":["CVE-2026-110331"],"related":[],"title":"abrt: local users can tamper with crash dump directories","description":"A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a \"count\" element, which an unprivileged user can create. This allows a local attacker to bypass the guard and again poison elements in, or seize ownership of, dump directories while privileged ABRT handlers are processing them. Related Problems2 mutating methods remain ungated by the same check.","summary":"ABRT, the Linux crash-reporting tool, has a flaw where a completeness check on crash dump directories can be bypassed by an unprivileged local user. An attacker can then alter dump elements or take ownership of dump directories while privileged ABRT handlers process them.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"abrt","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["abrt","linux","other","self-hosted"],"not_affected_if":["abrt-not-installed","no-local-untrusted-users"],"how_to_check":"- rpm -q abrt (or dpkg -l abrt): is ABRT installed, and which version. No fixed version is published yet.\n- systemctl status abrtd abrt-journal-core abrt-oops abrt-xorg: see which services run.\n- abrt-dbus is D-Bus activatable even when abrtd is stopped, so a stopped abrtd does not mean safe.\n- Also check whether untrusted local users can log in.\n- Workaround from Red Hat: systemctl disable --now abrtd.service abrt-journal-core.service abrt-oops.service abrt-xorg.service, or remove ABRT, and restrict local interactive access.","fix":null,"status":"open","published_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","triaged_at":"2026-11-13T22:34:22+00:00","updated_at":"2026-11-13T22:38:43+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T22:34:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"abrt: local users can tamper with crash dump directories","impact":"medium","summary":"ABRT, the Linux crash-reporting tool, has a flaw where a completeness check on crash dump directories can be bypassed by an unprivileged local user. An attacker can then alter dump elements or take ownership of dump directories while privileged ABRT handlers process them.","audience":"businesses","category":"other","nicknames":[],"who_cares":["linux","abrt","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user takes over crash dump directories processed by root handlers","analyst_note":"Find the affected and fixed abrt versions and the upstream advisory for CVE-2026-110331 via the NVD link; sources gave no product ranges.","how_to_check":"- `rpm -q abrt` or `dpkg -l abrt` to see whether ABRT is installed and at what version\n- Check whether the abrtd service is running: `systemctl status abrtd`","plain_action":"","product_name":"abrt","needs_analyst":true,"not_affected_if":["abrt-not-installed","no-local-untrusted-users"],"who_is_affected":"Systems that run ABRT with its crash-handling service enabled, where local users share the machine. The sources do not give affected version ranges or a fixed release. Systems without ABRT installed can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":4572,"output_tokens":542,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed abrt versions and the upstream advisory for CVE-2026-110331 via the NVD link; sources gave no product ranges.","search":"'-110331':12A,15A '-2026':11A,14A,80C,84C '-54228':81C '-54229':85C 'abrt':1A,16A,17B,23B,64B,72C,124C 'allow':103C 'alter':53B 'attack':50B,106C 'bypass':43B,108C 'check':36B,75C,138C 'complet':35B,74C 'contain':92C 'count':94C 'crash':7A,27B,38B 'crash-report':26B 'creat':101C 'cve':10A,13A,79C,83C 'directori':9A,40B,61B,91C,121C 'dump':8A,39B,54B,60B,90C,120C 'element':55B,95C,114C 'flaw':32B,68C 'found':70C 'guard':110C 'handler':65B,125C 'host':22B 'introduc':76C 'linux':18B,25B 'local':2A,47B,105C 'method':132C 'mitig':78C 'mutat':131C 'ownership':58B,118C 'poison':113C 'privileg':63B,123C 'problems2':130C 'process':66B,127C 'relat':129C 'remain':133C 'report':28B 'seiz':117C 'self':21B 'self-host':20B 'take':57B 'tamper':5A 'tool':29B 'ungat':134C 'unprivileg':46B,98C 'user':3A,48B,99C 'verifi':87C","nicknames":[],"mitigations":[],"who_affected":"Linux hosts with ABRT installed (Red Hat family distributions ship it) where unprivileged local users can log in. The completeness check added for CVE-2026-54228 and CVE-2026-54229 only looks for a 'count' element that a local user can create, so those two attacks work again. Single-user machines and hosts without ABRT can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["abrt"],"ptokens":["abrt"],"labels":["abrt","high","linux","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-110331':12A,15A '-2026':11A,14A 'abrt':1A,16A 'crash':7A 'cve':10A,13A 'directori':9A 'dump':8A 'local':2A 'tamper':5A 'user':3A","search_b":"'abrt':17B,23B,64B 'alter':53B 'attack':50B 'bypass':43B 'check':36B 'complet':35B 'crash':27B,38B 'crash-report':26B 'directori':40B,61B 'dump':39B,54B,60B 'element':55B 'flaw':32B 'handler':65B 'host':22B 'linux':18B,25B 'local':47B 'ownership':58B 'privileg':63B 'process':66B 'report':28B 'self':21B 'self-host':20B 'take':57B 'tool':29B 'unprivileg':46B 'user':48B","search_c":"'-2026':80C,84C '-54228':81C '-54229':85C 'abrt':72C,124C 'allow':103C 'attack':106C 'bypass':108C 'check':75C,138C 'complet':74C 'contain':92C 'count':94C 'creat':101C 'cve':79C,83C 'directori':91C,121C 'dump':90C,120C 'element':95C,114C 'flaw':68C 'found':70C 'guard':110C 'handler':125C 'introduc':76C 'local':105C 'method':132C 'mitig':78C 'mutat':131C 'ownership':118C 'poison':113C 'privileg':123C 'problems2':130C 'process':127C 'relat':129C 'remain':133C 'seiz':117C 'ungat':134C 'unprivileg':98C 'user':99C 'verifi':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110331","severity":null,"published_at":"2026-11-13T22:17:21+00:00","modified_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","fetched_at":"2026-11-13T22:33:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110331:3948","url":"https://access.redhat.com/security/cve/CVE-2026-110331","severity":null,"published_at":"2026-11-13T22:38:43+00:00","modified_at":"2026-11-13T22:38:43+00:00","first_seen_at":"2026-11-13T22:38:43+00:00","fetched_at":"2026-11-13T22:38:43+00:00","note":"Red Hat CVE page read: no fixed version or affected range yet, only a mitigation (disable ABRT services). Upstream changelog lists the earlier fixes in 2.17.9, nothing for this CVE. No PoC or exploitation seen. Bugzilla 2552067. Nothing verified: no vendor fix statement. X not checked.","cites":["https://access.redhat.com/security/cve/CVE-2026-110331","https://github.com/abrt/abrt/blob/master/CHANGELOG.md"]}],"documents":[{"id":150677,"url":"https://access.redhat.com/security/cve/CVE-2026-110331","title":"Red Hat CVE-2026-110331","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":150678,"url":"https://github.com/abrt/abrt/blob/master/CHANGELOG.md","title":"abrt CHANGELOG","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}