Privilege escalation in Red Hat's bug reporting tool ABRT (CVE-2015-5287) — why a predictable filename is dangerous

1How a symlink attack works

A symbolic link lets one filename act as a reference to another file. The attack targets the moment a privileged program is about to create or write a file with a particular name. If the attacker gets there first and creates a link under that name pointing at some other important file, the privileged program writes not where it intended but to the target of the link.

The structure is that the attacker gets a privileged program to write, on their behalf, somewhere their own privileges could not reach.

2Why "predictable" is the condition

For this to work, the attacker has to know in advance the filename the privileged program will use. Names built from a process ID or a fixed string can be guessed, which makes getting there first possible. That is why the discipline for temporary files is to generate unguessable names by a safe method and to open them in a way that fails if the file already exists. A predictable name is itself the precondition for the vulnerability.

3A bug reporting tool as the route

ABRT gathers and reports information when a program terminates abnormally. Collecting that information requires reaching into other processes' state and their core dumps, so tools of this kind run with elevated privilege. It is an example of unremarked background machinery becoming an attack route precisely because it holds privilege.

4Getting there first, and having it written for you

A symlink attack borrows the privilege of a privileged program to write where the attacker cannot. Following how it completes shows where the condition sits.

1. 1Learn the nameThe file name the privileged program uses is predictable from a process ID or a fixed string
2. 2Get there firstThe attacker creates a link under that name, pointing at some other important file
3. 3The privileged program writesIt writes not where it intended but to the far side of the link
4. 4Privilege is crossedThe privileged program has written, on the attacker's behalf, where the attacker could not

The first step is the condition. That is why temporary files call for names generated unpredictably by a safe method, opened so that creation fails if a file already exists. A predictable name is itself the precondition for the vulnerability.