Exploitation Summary
EIP tracks 3 public exploits for CVE-2015-3315.
PoCs published by Metasploit, Tavis Ormandy, Tavis Ormandy, bcoles, including Metasploit module exploits/linux/local/abrt_raceabrt_priv_esc.
AI-analyzed exploit summary This Metasploit module exploits a race condition in ABRT (CVE-2015-3315) to escalate privileges by changing ownership of /etc/passwd and adding a new root user. It uses a symlink attack on '/var/tmp/abrt/*/maps' to achieve this.
Description
Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink attack on (1) /var/tmp/abrt/*/maps, (2) /tmp/jvm-*/hs_error.log, (3) /proc/*/exe, (4) /etc/os-release in a chroot, or (5) an unspecified root directory related to librpm.
Exploits (3)
This Metasploit module exploits a race condition in ABRT (CVE-2015-3315) to escalate privileges by changing ownership of /etc/passwd and adding a new root user. It uses a symlink attack on '/var/tmp/abrt/*/maps' to achieve this.
This exploit leverages a race condition in ABRT (Automatic Bug Reporting Tool) on Fedora 21 to gain ownership of arbitrary files by manipulating symlinks during crash report generation. It uses inotify to monitor ABRT's temporary directory and attempts to replace the 'maps' file with a symlink to the target file.
This Metasploit module exploits a race condition in ABRT (CVE-2015-3315) to escalate privileges by changing ownership of /etc/passwd and adding a new root user. It uses a symlink attack on /var/tmp/abrt/*/maps to achieve this.
References (11)
Scores
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H