Critical Privilege Escalation in Red Hat ABRT (CVE‑2015‑5287) Threatens Linux System Integrity
What It Is – Red Hat’s Automatic Bug Reporting Tool (ABRT) contains a local privilege‑escalation flaw (CVE‑2015‑5287). An attacker with limited permissions can craft a symlink to a predictable‑name file, causing ABRT to execute with elevated rights and granting the attacker higher privileges on the host.
Exploitability – The vulnerability is exploitable locally on any affected RHEL system; no public exploit code is required, and it can be triggered on both supported and end‑of‑life releases.
Affected Products – Red Hat Enterprise Linux (RHEL) installations that include ABRT, including versions that have reached end‑of‑life or end‑of‑service.
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in vulnerability‑management controls; continuous patching evidence is essential for audit readiness.
- Remediation (patch or upgrade) must be recorded to provide defensible proof of due‑diligence to regulators and enterprise partners.
- The issue highlights the need for control mapping across frameworks (e.g., NIST CSF 2.0) to show that patch‑management objectives are being met.
Recommended Actions
- Apply Red Hat’s security advisory patch for ABRT or upgrade to a supported RHEL version.
- Disable ABRT on systems where it is not required.
- Record remediation steps in your vulnerability‑management system and retain evidence for audit purposes.
Source: CISA KEV – CVE‑2015‑5287