A race condition exists in the abrt-dbus D-Bus service’s ChownProblemDir method. The method opens the dump directory with a read‑only flag and then changes the ownership of every file in that directory to the caller’s UID. Because the operation succeeds even when event handlers still hold a write lock, an attacker can gain control of the dump directory while privileged event scripts are executing. This allows local users to modify or access files that should remain protected, enabling filesystem‑level privilege escalation.

Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8 are affected by this flaw.

The CVSS score of 7 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, which suggests it has not yet been widely exploited in the wild. However, the attack requires local access to the affected systems. Once local access is obtained, the ability to claim ownership of the dump directory during active event processing presents a clear pathway for privilege escalation, especially on systems where ABRT is enabled and event scripts run with elevated privileges.