erroneo.us
Search all guides⌘K

Security Digest · Nov 23, 2015 · Vulnerability · OS / kernel

ABRT CVE-2015-5287: 2015 RHEL 7 Local Root Bug Now in KEV

ABRT symlink flaw gives local root on unpatched RHEL/CentOS 7; fixed Nov 2015 (abrt-2.1.11-35.el7), in CISA KEV since Aug 2026. Only long-unpatched hosts.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Most can relax

This is a ten-year-old local root bug that any RHEL 7 or CentOS 7 host updated since late 2015 already has fixed; the KEV listing matters only for forgotten, never-patched machines, and those have bigger problems.

Who must act: Anyone still running RHEL 7, CentOS 7 or similar hosts with abrt older than 2.1.11-35.el7, especially shared or multi-user systems and old appliances built on CentOS 7.

Who can relax: RHEL 6 (not affected per Red Hat), systems that do not have ABRT installed, and any RHEL 7 or CentOS 7 host that has taken routine updates since November 2015.

Affected
ABRT before 2.7.1 (upstream)
RHEL 7 abrt before 2.1.11-35.el7 and libreport before 2.1.11-31.el7
CentOS 7 and Fedora 22-era systems with the same unpatched ABRT
Fixed in
RHEL 7: abrt-2.1.11-35.el7 and libreport-2.1.11-31.el7 (RHSA-2015:2505)
ABRT 2.7.1 upstream
CVSS
7.8 (v3.1, NVD)
EPSS
5.0% (percentile 92)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory remaining RHEL 7, CentOS 7 and derived hosts and appliances.
  2. Check the installed version with rpm -q abrt libreport and update with yum update abrt libreport if older than the RHSA-2015:2505 builds.
  3. Where ABRT is not needed, disable its crash hook: systemctl disable --now abrt-ccpp.
  4. Plan migration off CentOS 7 (end of life June 30, 2024) or buy RHEL 7 Extended Life Cycle Support.

How to check if you are affected or compromised

  • Run cat /proc/sys/kernel/modprobe; anything other than the normal modprobe path (usually /sbin/modprobe) is a red flag.
  • Look for symlinks or files named abrt-hax-coredump under /var/tmp/abrt or /var/spool/abrt, and for test binaries named abrt-* in /tmp.
  • On any old host where this bug was open, review who had shell access and look for new root-owned files, cron jobs and SSH keys.

What happened#

ABRT, the Automatic Bug Reporting Tool, is the crash handler on Red Hat Enterprise Linux 7, CentOS 7 and Fedora. When a program crashes, the kernel hands the core dump to ABRT's abrt-hook-ccpp helper. CVE-2015-5287 covers how that helper saved dumps of ABRT's own programs. It wrote them to a predictable path such as /var/tmp/abrt/abrt-hax-coredump without refusing symbolic links. Red Hat says a local attacker with write access to an ABRT problem directory "could use this flaw to escalate their privileges". Red Hat rated it Moderate and shipped fixed packages on November 23, 2015, in RHSA-2015:2505. The upstream fix landed in ABRT 2.7.1.

Philip Pettersson, who reported the bug, published exploits on oss-security on December 1, 2015. His write-up points the dump path at /proc/sys/kernel/modprobe and crashes a program named abrt-*. Chained with a related ABRT bug (CVE-2015-5273), that turns an unprivileged local user into root on RHEL 7.0/7.1 and CentOS 7.1. A Metasploit module that cites this CVE automates a related sosreport-based root chain, tested on RHEL 7.0 and 7.1.

On August 26, 2026, CISA added the CVE to the KEV catalog, with a September 9 deadline for federal agencies. The same batch included two other old Linux local privilege escalations: CVE-2015-3246 in libuser and the kernel bug CVE-2022-0995. CISA cites only "evidence of active exploitation". It has not said who is exploiting these bugs or how, and press coverage names no actor. Local privilege escalation bugs are typically used after an attacker already has a shell, to get from a web or service account to root. That is the plausible role here, but it is not confirmed as of October 21, 2026. NVD scores it CVSS 3.1 7.8.

Who is affected#

  • RHEL 7 with abrt older than 2.1.11-35.el7 or libreport older than 2.1.11-31.el7. That means a host that has not taken updates since November 2015.
  • CentOS 7 and Fedora systems from that era with the same unpatched ABRT, including appliances and images built on CentOS 7 and then frozen.
  • Not affected: RHEL 6, according to Red Hat, and any system without ABRT installed (rpm -q abrt returns "not installed").

The attack is local. It needs a shell or code execution on the box, so it is a second-stage bug, not a way in.

Do you really need to act?#

For nearly everyone, no. The fix is almost eleven years old and arrived through ordinary yum update. The honest concern is the long tail. CentOS Linux 7 reached end of life on June 30, 2024, and RHEL 7 left maintenance the same day. Machines that were never patched still exist, usually as vendor appliances, lab boxes or "do not touch" production servers. A host still missing a 2015 fix is also missing years of kernel and OpenSSL fixes. Treat any such host as a migration problem, not a single-CVE problem.

What to do now#

  1. Find what is left: cat /etc/redhat-release across your fleet, or query your CMDB for EL7 hosts and appliances.
  2. Check ABRT on each one: rpm -q abrt libreport. Anything older than the RHSA-2015:2505 builds needs yum update abrt libreport.
  3. If you don't need automatic crash reporting, turn off the hook: systemctl disable --now abrt-ccpp, and confirm cat /proc/sys/kernel/core_pattern no longer pipes to abrt-hook-ccpp.
  4. Schedule migration off CentOS 7, or put RHEL 7 hosts on Extended Life Cycle Support, which Red Hat offers for RHEL 7.9 until May 31, 2029.

How to tell if you were hit#

The public exploit technique overwrites the kernel's modprobe helper path. Check cat /proc/sys/kernel/modprobe: on a normal system it points at the real modprobe, usually /sbin/modprobe. Look for symlinks or files named abrt-hax-coredump under /var/tmp/abrt or /var/spool/abrt, and for throwaway binaries named abrt-* in /tmp. Because this bug only matters after an attacker already has local access, also look for that first foothold: unfamiliar logins, web shells and new SSH keys. Then check for root persistence such as new cron jobs, systemd units or setuid binaries.

Timeline#

  • — Red Hat publishes RHSA-2015:2505 with fixed abrt and libreport for RHEL 7.
  • — Philip Pettersson posts details and exploits to oss-security.
  • — The CVE record is published.
  • — CentOS Linux 7 reaches end of life, and RHEL 7 leaves maintenance.
  • — CISA adds CVE-2015-5287 to KEV, citing evidence of active exploitation.
  • — Federal remediation deadline.

Vulnerability records

  • CVE-2015-5287 · KEV 2026-08-26 · The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Red Hat — CVE-2015-5287 access.redhat.com
  2. Red Hat — RHSA-2015:2505 abrt and libreport security update access.redhat.com
  3. ABRT / GitHub — Fix commit 3c1b60c github.com
  4. CVE record — CVE-2015-5287 cve.org
  5. NVD — CVE-2015-5287 nvd.nist.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2015-5287 cisa.gov
  7. CISA — CISA Adds Six Known Exploited Vulnerabilities to Catalog (Aug 26, 2026) cisa.gov
  8. Philip Pettersson via oss-security — Multiple vulnerabilities in ABRT and sosreport (Dec 1, 2015) openwall.com
  9. Rapid7 Metasploit — ABRT sosreport Privilege Escalation module github.com
  10. Red Hat — CentOS Linux end of life redhat.com

Coverage and analysis

  1. The Hacker News — CISA Adds Six Exploited Flaws to KEV thehackernews.com