CVE-2015-5287 Sumo Logic CSE · Sumo

Detect CVE-2015-5287: Red Hat ABRT sosreport Local Privilege Escalation in Sumo Logic CSE

Detects local privilege escalation exploitation of CVE-2015-5287 in Red Hat's Automatic Bug Reporting Tool (ABRT). A race condition and improper file handling in the sosreport/abrt-action-install-debuginfo path allows a local unprivileged user to manipulate files created by the privileged abrtd daemon (running as root), enabling arbitrary file write/overwrite and command execution as root. Exploitation is characterized by unusual abrt process activity, symlink/hardlink manipulation inside /var/spool/abrt and /var/tmp/abrt, and abrt-hook-ccpp or sosreport spawning shells as root shortly after a crash is triggered by a non-root user.

MITRE ATT&CK

Tactic
Privilege Escalation

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=*linux* ("abrtd" OR "abrt-hook-ccpp" OR "abrt-action-install-debuginfo" OR "sosreport")
| parse "ppid=* " as parent_process nodrop
| parse "comm=\"*\"" as process nodrop
| parse "uid=*" as uid nodrop
| where (process matches "*sh*" or process matches "*chmod*" or process matches "*cp*")
| where uid = "0"
| count by _sourceHost, parent_process, process, uid
high severity medium confidence

Sumo Logic query detecting abrt daemon components launching root shells/file-manipulation commands, a signature of CVE-2015-5287 exploitation.

Data Sources

Linux auditdLinux system logs

Required Tables

linux_auditdlinux_syslog

False Positives & Tuning

  • Legitimate support bundle creation
  • Genuine crash debuginfo handling
  • Admin-run sosreport

Other platforms for CVE-2015-5287

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate abrt-parented root shell

    Expected signal: Process launch event with parent basename abrt-action-install-debuginfo, child /bin/bash running as uid=0

  2. Test 2Symlink race in abrt spool directory

    Expected signal: File create/symlink event under /var/spool/abrt pointing to a sensitive system file

  3. Test 3sosreport spawning shell as root

    Expected signal: Process launch with parent basename sosreport(-test) and child shell as root while triggered from non-root context

Last updated: 2026-08-27 Research depth: standard
References (7)

Response Playbook

Triage

  1. Confirm the affected host runs a vulnerable Red Hat / RHEL-derived distribution with the abrt package (abrt, abrt-addon-ccpp) installed and unpatched (pre-fix commit 3c1b60cf).
  2. Identify the non-root initiating user who triggered the crash and correlate with the timestamp of the root shell/command spawned by the abrt component.
  3. Inspect /var/spool/abrt and /var/tmp/abrt for attacker-controlled symlinks, hardlinks, or files with unexpected ownership created around the event time.
  4. Verify whether the spawned root process performed writes to sensitive paths (e.g., /etc/passwd, /etc/cron.d, setuid binaries).

Containment

  1. Isolate the affected host from the network to prevent lateral movement from the escalated root context.
  2. Suspend or lock the identified non-root user account pending investigation.
  3. Stop the abrtd service (systemctl stop abrtd) and disable crash processing until the host is patched.

Evidence Collection

  1. Collect the full contents of /var/spool/abrt/ and /var/tmp/abrt/ including problem directories, symlinks and their targets.
  2. Preserve auditd logs, /var/log/messages, /var/log/secure and abrt logs covering the event window.
  3. Capture the process tree and command lines for the abrt parent and its root child, plus any files created/modified by that child.

Escalation Criteria

  • !Escalate to incident response if the root process modified authentication, cron, sudoers, or setuid files, indicating successful privilege escalation and persistence.
  • !Escalate if evidence shows the escalated context was used for lateral movement, credential theft, or additional payload execution.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Symlinks/hardlinks and orphaned files under /var/spool/abrt and /var/tmp/abrt
  • >auditd EXECVE records showing abrt component parents spawning shells as root
  • >abrt problem directory metadata (uid, executable, time) inconsistent with a normal crash

Tuning Guidance

Baseline legitimate sosreport and abrt debuginfo activity for your fleet (support engineers, monitoring agents) and allowlist those service accounts/hosts. Focus alerting on cases where the initiating/originating user is a standard non-root interactive user and the child process is a shell, scripting interpreter, chmod +s, or a copy of a shell binary. Tighten confidence to high when file writes to /etc or setuid paths accompany the root child.

Hunting Queries

Surfaces any abrt-parented process running as root while the originating user is non-root, the core anomaly behind CVE-2015-5287.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName startswith "abrt" or InitiatingProcessFileName == "sosreport" | where AccountName =~ "root" and InitiatingProcessAccountName !~ "root" | project Timestamp, DeviceName, InitiatingProcessAccountName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
Hunting — SPL
spl 
index=linux (parent_process=abrtd OR parent_process="abrt-hook-ccpp" OR parent_process=sosreport) user=root parent_user!=root | stats count by host, parent_process, process, user, parent_user

Atomic Red Team Tests

Test 1 Simulate abrt-parented root shell
linux

Emulates CVE-2015-5287 telemetry by having a mock abrt component spawn a root shell command in a lab.

Command

bash 
sudo bash -c 'cp /bin/bash /tmp/abrt-action-install-debuginfo && /tmp/abrt-action-install-debuginfo -c "id > /tmp/abrt_privesc_test.txt"'

Cleanup

bash 
sudo rm -f /tmp/abrt-action-install-debuginfo /tmp/abrt_privesc_test.txt

Expected Telemetry

Process launch event with parent basename abrt-action-install-debuginfo, child /bin/bash running as uid=0

Expected Detection

KQL/EQL/CQL rules fire on abrt-parented root shell execution

Test 2 Symlink race in abrt spool directory
linux

Creates a symlink inside the abrt spool path to emulate the file-handling race abused by the exploit.

Command

bash 
sudo mkdir -p /var/spool/abrt/ccpp-test && ln -sf /etc/passwd /var/spool/abrt/ccpp-test/maps

Cleanup

bash 
sudo rm -rf /var/spool/abrt/ccpp-test

Expected Telemetry

File create/symlink event under /var/spool/abrt pointing to a sensitive system file

Expected Detection

Forensic artifact review and file-integrity monitoring flag the symlink target anomaly

Test 3 sosreport spawning shell as root
linux

Runs a stand-in sosreport binary that launches a shell to emulate the escalation payload.

Command

bash 
sudo bash -c 'cp /bin/sh /usr/local/bin/sosreport-test && sudo -u nobody sh -c "/usr/local/bin/sosreport-test -c \"id\"" 2>/dev/null; /usr/local/bin/sosreport-test -c "id"'

Cleanup

bash 
sudo rm -f /usr/local/bin/sosreport-test

Expected Telemetry

Process launch with parent basename sosreport(-test) and child shell as root while triggered from non-root context

Expected Detection

SPL/QRadar/Sumo/Chronicle rules detect sosreport-parented root shell

Related Detections

Tactic Hub

TA0004Privilege Escalation

Related Techniques

T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control Mechanism

Same Tactic: Privilege Escalation

Popular Detections