CVE-2015-5287 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2015-12-07

Added to CISA KEV: 2026-08-26 3915 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This vulnerability is in CISA KEV indicating active exploitation. Because it is a local privilege escalation used post-compromise, review hosts for signs of prior initial access and lateral movement. Inspect /var/tmp/abrt and /var/spool/abrt for suspicious symlinks, and audit for unexpected root-level activity and unauthorized accounts.
Immediately update ABRT to version 2.7.1 or later, or apply vendor patches (RHSA-2015:2505 and equivalent CentOS/Fedora/Oracle updates).
If patching is not immediately possible, disable the ABRT service or restrict access to the coredump directories to prevent symlink manipulation. Consider disabling core dumps for unprivileged processes where feasible.
Monitor for chained exploitation: since this enables root escalation after initial foothold, harden internet-facing services (the true T1190 entry points) and deploy EDR to detect privilege-escalation attempts and symlink abuse.
Patch priority: HIGH for any RHEL/CentOS/Fedora host, especially multi-user systems and servers reachable from lower-trust segments — despite being local-only, it is actively weaponized as a privilege escalation step.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2015-5287 is a local privilege escalation vulnerability within the `abrt-hook-ccpp` component of the Red Hat Automatic Bug Reporting Tool (ABRT) ^[2]^[3]. The flaw exists because the tool incorrectly handles symbolic links when writing coredumps to predictable file locations in directories like `/var/tmp` or `/var/spool` ^[1]^[2]. This is a critical issue because it allows an authenticated local user with specific permissions to manipulate file operations, ultimately leading to unauthorized root-level access on the affected system ^[1]^[3].

Exploitation

Active Exploitation: The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming it has been actively exploited in the wild ^[1].
Tooling: A public proof-of-concept exploit is available, and an exploit module is included in the Metasploit Framework to facilitate local privilege escalation on vulnerable Red Hat Enterprise Linux (RHEL) systems ^[4]^[5].
Attack Prerequisites: This is a local attack vector; it requires the attacker to have an existing authenticated session on the target machine ^[1]. No network access is required for the initial exploitation, and no specific user interaction (such as a victim opening a file) is necessary once the attacker has local access.

Affected Products & Patches

Affected Versions: The vulnerability affects versions of the Automatic Bug Reporting Tool (ABRT) prior to 2.7.1 ^[3]^[6].
Patches: Updates addressing this vulnerability were provided by Red Hat and other relevant package maintainers in 2015/2016. Systems should be updated to a version of ABRT at or above 2.7.1 to mitigate the flaw.
Mitigations: If an immediate upgrade is not possible, organizations are advised to disable the ABRT service or restrict access to the directories where the tool writes crash dumps to prevent symlink manipulation.

Impact

System Access: Successful exploitation provides the attacker with full root privileges, effectively granting complete control over the compromised operating system ^[1]^[4].
Business Risk: For internet-facing deployments, the risk is severe; if an attacker manages to gain a foothold on the system through a lower-privileged service (e.g., a web server or application vulnerability), CVE-2015-5287 serves as a critical post-exploitation vector to escalate privileges, move laterally, or persist within the environment with administrative authority.

Sources

CVE-2015-5287 · Red Hat · CVSS 9.5 · CISA KEV · CVE Brief Analyst Report
Red Hat · Automatic Bug Reporting Tool (ABRT) The ABRT tool contains a local privilege escalation vulnerability via symlink attacks on predictable file names in /var/tmp or /var/spool, allowing authenticated local users to gain root privileges. Quick facts CVSS score 9.5 (Critical) CISA KEV Listed (…
CVE-2015-5287
It was discovered that the kernel-invoked coredump processor provided by ABRT did not handle symbolic links correctly when writing core dumps ... CVE Details App For open source software shipped by multiple vendors, the CVSS base scores may vary for each vendor's version depending on the version the…
CVE Record: CVE-2015-5287
Description. The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to ... CVE Program This container includes required additional information provided by the CVE Program for this vulnerability.
metasploit-framework/documentation/modules/exploit/linux ...
This module attempts to gain root privileges on RHEL systems with a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured as the crash ...
RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation
RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation. CVE-2015-5287 . local exploit for Linux platform.

🟢 CVE-2015-5287