CVE-2015-5287

ABRT sosreport Privilege Escalation

Title source: metasploit
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2015-5287. PoCs published by Metasploit, rebel, rebel, bcoles, including Metasploit module exploits/linux/local/abrt_sosreport_priv_esc.

AI-analyzed exploit summary This Metasploit module exploits CVE-2015-5287, a privilege escalation vulnerability in ABRT's sosreport on RHEL systems. It uses a symlink attack to overwrite the modprobe path, achieving root privileges.

Description

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocallinux
https://www.exploit-db.com/exploits/47421

This Metasploit module exploits CVE-2015-5287, a privilege escalation vulnerability in ABRT's sosreport on RHEL systems. It uses a symlink attack to overwrite the modprobe path, achieving root privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: ABRT (Automatic Bug Reporting Tool) versions < 2.1.11-35.el7 on RHEL 7.x
No auth needed
Prerequisites: ABRT configured as crash handler · abrt-ccpp service running · Python installed · Vulnerable ABRT version
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by rebel · pythonlocalmultiple
https://www.exploit-db.com/exploits/38835

This exploit leverages CVE-2015-5287 and CVE-2015-5273 to achieve local privilege escalation on CentOS 7.1/Fedora 22 by abusing insecure file operations in abrt-hook-ccpp and abrt-action-install-debuginfo. It manipulates symbolic links and coredump handling to overwrite /proc/sys/kernel/modprobe, leading to root shell execution.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: abrt (Automatic Bug Reporting Tool) on CentOS 7.1/Fedora 22
No auth needed
Prerequisites: Local access to the target system · abrt installed and running · Python interpreter
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by rebel · pythonlocallinux
https://www.exploit-db.com/exploits/38832

This exploit leverages a race condition in abrt/sosreport on RHEL 7.0/7.1 to achieve local privilege escalation by manipulating symbolic links and triggering a modprobe path override. It creates a suid shell to gain root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: abrt/sosreport on RHEL 7.0/7.1
Auth required
Prerequisites: Local access to a vulnerable RHEL 7.0/7.1 system · User permissions to execute scripts
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by rebel, bcoles · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/abrt_sosreport_priv_esc.rb

This Metasploit module exploits CVE-2015-5287, a privilege escalation vulnerability in ABRT's sosreport on RHEL systems. It uses a symlink attack to overwrite the modprobe path, achieving root privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: ABRT (Automatic Bug Reporting Tool) versions < 2.1.11-35.el7 on RHEL 7.x
No auth needed
Prerequisites: ABRT configured as crash handler · abrt-ccpp service running · Python installed · Vulnerable ABRT version
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (8)

Core 8
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2505.html
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/38832/
Exploit mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/12/01/1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/78137

Scores

EPSS 0.1290
EPSS Percentile 94.2%

Details

CWE
CWE-59
Status published
Products (5)
redhat/automatic_bug_reporting_tool < 2.7.0
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_hpc_node 7.0
redhat/enterprise_linux_server 7.0
redhat/enterprise_linux_workstation 7.0
Published Dec 07, 2015
Tracked Since Feb 18, 2026