Detect CVE-2015-5287: Red Hat ABRT sosreport Local Privilege Escalation in IBM QRadar
Detects local privilege escalation exploitation of CVE-2015-5287 in Red Hat's Automatic Bug Reporting Tool (ABRT). A race condition and improper file handling in the sosreport/abrt-action-install-debuginfo path allows a local unprivileged user to manipulate files created by the privileged abrtd daemon (running as root), enabling arbitrary file write/overwrite and command execution as root. Exploitation is characterized by unusual abrt process activity, symlink/hardlink manipulation inside /var/spool/abrt and /var/tmp/abrt, and abrt-hook-ccpp or sosreport spawning shells as root shortly after a crash is triggered by a non-root user.
MITRE ATT&CK
- Tactic
- Privilege Escalation
QRadar Detection Query
SELECT QIDNAME(qid) AS event, sourceip, username, "ParentProcessName", "ProcessName", "CommandLine"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Linux%'
AND "ParentProcessName" IN ('abrtd','abrt-hook-ccpp','abrt-action-install-debuginfo','sosreport')
AND ("CommandLine" ILIKE '%/bin/sh%' OR "CommandLine" ILIKE '%/bin/bash%' OR "CommandLine" ILIKE '%chmod +s%' OR "CommandLine" ILIKE '%cp /bin/sh%')
AND username = 'root'
LAST 24 HOURSQRadar AQL query surfacing abrt-spawned root shells or setuid manipulation on Linux log sources indicative of CVE-2015-5287 privilege escalation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate sosreport execution by support staff
- Normal abrt debuginfo collection
- Automated bundle generation tooling
Other platforms for CVE-2015-5287
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate abrt-parented root shell
Expected signal: Process launch event with parent basename abrt-action-install-debuginfo, child /bin/bash running as uid=0
- Test 2Symlink race in abrt spool directory
Expected signal: File create/symlink event under /var/spool/abrt pointing to a sensitive system file
- Test 3sosreport spawning shell as root
Expected signal: Process launch with parent basename sosreport(-test) and child shell as root while triggered from non-root context
References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2015-5287
- https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e
- https://www.exploit-db.com/exploits/47421
- https://www.exploit-db.com/exploits/38832
- https://www.exploit-db.com/exploits/38835
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/abrt_sosreport_priv_esc.rb
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
Response Playbook
Triage
- Confirm the affected host runs a vulnerable Red Hat / RHEL-derived distribution with the abrt package (abrt, abrt-addon-ccpp) installed and unpatched (pre-fix commit 3c1b60cf).
- Identify the non-root initiating user who triggered the crash and correlate with the timestamp of the root shell/command spawned by the abrt component.
- Inspect /var/spool/abrt and /var/tmp/abrt for attacker-controlled symlinks, hardlinks, or files with unexpected ownership created around the event time.
- Verify whether the spawned root process performed writes to sensitive paths (e.g., /etc/passwd, /etc/cron.d, setuid binaries).
Containment
- Isolate the affected host from the network to prevent lateral movement from the escalated root context.
- Suspend or lock the identified non-root user account pending investigation.
- Stop the abrtd service (systemctl stop abrtd) and disable crash processing until the host is patched.
Evidence Collection
- Collect the full contents of /var/spool/abrt/ and /var/tmp/abrt/ including problem directories, symlinks and their targets.
- Preserve auditd logs, /var/log/messages, /var/log/secure and abrt logs covering the event window.
- Capture the process tree and command lines for the abrt parent and its root child, plus any files created/modified by that child.
Escalation Criteria
- !Escalate to incident response if the root process modified authentication, cron, sudoers, or setuid files, indicating successful privilege escalation and persistence.
- !Escalate if evidence shows the escalated context was used for lateral movement, credential theft, or additional payload execution.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Symlinks/hardlinks and orphaned files under /var/spool/abrt and /var/tmp/abrt - >
auditd EXECVE records showing abrt component parents spawning shells as root - >
abrt problem directory metadata (uid, executable, time) inconsistent with a normal crash
Tuning Guidance
Baseline legitimate sosreport and abrt debuginfo activity for your fleet (support engineers, monitoring agents) and allowlist those service accounts/hosts. Focus alerting on cases where the initiating/originating user is a standard non-root interactive user and the child process is a shell, scripting interpreter, chmod +s, or a copy of a shell binary. Tighten confidence to high when file writes to /etc or setuid paths accompany the root child.
Hunting Queries
Surfaces any abrt-parented process running as root while the originating user is non-root, the core anomaly behind CVE-2015-5287.
DeviceProcessEvents | where InitiatingProcessFileName startswith "abrt" or InitiatingProcessFileName == "sosreport" | where AccountName =~ "root" and InitiatingProcessAccountName !~ "root" | project Timestamp, DeviceName, InitiatingProcessAccountName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLineindex=linux (parent_process=abrtd OR parent_process="abrt-hook-ccpp" OR parent_process=sosreport) user=root parent_user!=root | stats count by host, parent_process, process, user, parent_userAtomic Red Team Tests
Emulates CVE-2015-5287 telemetry by having a mock abrt component spawn a root shell command in a lab.
Command
sudo bash -c 'cp /bin/bash /tmp/abrt-action-install-debuginfo && /tmp/abrt-action-install-debuginfo -c "id > /tmp/abrt_privesc_test.txt"'Cleanup
sudo rm -f /tmp/abrt-action-install-debuginfo /tmp/abrt_privesc_test.txtExpected Telemetry
Process launch event with parent basename abrt-action-install-debuginfo, child /bin/bash running as uid=0
Expected Detection
KQL/EQL/CQL rules fire on abrt-parented root shell execution
Creates a symlink inside the abrt spool path to emulate the file-handling race abused by the exploit.
Command
sudo mkdir -p /var/spool/abrt/ccpp-test && ln -sf /etc/passwd /var/spool/abrt/ccpp-test/mapsCleanup
sudo rm -rf /var/spool/abrt/ccpp-testExpected Telemetry
File create/symlink event under /var/spool/abrt pointing to a sensitive system file
Expected Detection
Forensic artifact review and file-integrity monitoring flag the symlink target anomaly
Runs a stand-in sosreport binary that launches a shell to emulate the escalation payload.
Command
sudo bash -c 'cp /bin/sh /usr/local/bin/sosreport-test && sudo -u nobody sh -c "/usr/local/bin/sosreport-test -c \"id\"" 2>/dev/null; /usr/local/bin/sosreport-test -c "id"'Cleanup
sudo rm -f /usr/local/bin/sosreport-testExpected Telemetry
Process launch with parent basename sosreport(-test) and child shell as root while triggered from non-root context
Expected Detection
SPL/QRadar/Sumo/Chronicle rules detect sosreport-parented root shell