CVE-2025-12744: ABRT Daemon RCE Vulnerability

CVE-2025-12744 Overview

CVE-2025-12744 is a command injection flaw in the Automatic Bug Reporting Tool (ABRT) daemon. ABRT copies up to 12 characters from user-supplied mount information and passes them directly into a shell command of the form docker inspect %s without sanitization. An unprivileged local user can inject shell metacharacters through this input. Because the ABRT daemon runs as root, the injected commands execute with root privileges. The result is full local privilege escalation from an unprivileged account to root. The weakness is tracked as [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
A local, low-privileged user can execute arbitrary commands as root by injecting shell metacharacters into mount information consumed by the ABRT daemon.

Affected Products

Red Hat distributions shipping the ABRT daemon (see Red Hat CVE-2025-12744 Advisory)
ABRT package versions that pass mount input into docker inspect without validation
Systems where the ABRT service runs with root privileges

Discovery Timeline

2025-12-03 - CVE-2025-12744 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12744

Vulnerability Analysis

The ABRT daemon collects crash and diagnostic data from processes on Linux systems. As part of that workflow, it examines mount information to determine whether a crashing process runs inside a container. When container context is suspected, ABRT invokes the shell command docker inspect %s, substituting a string taken from user-controllable mount data into the %s placeholder.

The daemon copies up to 12 characters from this untrusted input into the command string. No escaping, quoting, or allowlist validation is applied before the string reaches a shell interpreter. Any shell metacharacter within those 12 bytes (for example `, $(), ;, |, or &) is interpreted by the shell rather than treated as literal data.

Because ABRT executes as root, any command injected through this path also runs as root. The impact extends beyond the ABRT process itself because the compromise crosses a privilege boundary from an unprivileged local account to full system control.

Root Cause

The root cause is unsafe construction of a shell command from untrusted input, classified under [CWE-78]. The daemon concatenates attacker-influenced data into a command string passed to a shell rather than invoking docker inspect through an argument vector that bypasses shell parsing. Truncating the input to 12 characters does not mitigate injection because compact payloads such as `id` or $(sh) fit well within that budget.

Attack Vector

Exploitation requires local access with low privileges but no user interaction. An attacker prepares a filesystem mount whose identifying information contains shell metacharacters within the first 12 bytes consumed by ABRT. The attacker then triggers a crash or diagnostic event that causes ABRT to inspect that mount. ABRT builds the docker inspect command with the injected payload and executes it through a shell as root. See the Red Hat Bug Report #2412467 for background on the reporting workflow.

Detection Methods for CVE-2025-12744

Indicators of Compromise

Unexpected child processes spawned by the ABRT daemon, particularly shells such as /bin/sh, /bin/bash, or interpreters like python and perl
Invocations of docker inspect originating from ABRT with unusual arguments containing metacharacters
New privileged accounts, SUID binaries, or SSH keys created shortly after an ABRT crash-handling event
Modifications to /etc/passwd, /etc/shadow, or /etc/sudoers correlated in time with ABRT activity

Detection Strategies

Audit process ancestry to flag any non-docker child process launched by ABRT components such as abrt-hook-ccpp or abrtd
Use auditd rules on execve to capture command lines executed by ABRT and alert on shell metacharacters in arguments
Review ABRT logs under /var/log/ and /var/spool/abrt/ for crash reports referencing crafted mount paths

Monitoring Recommendations

Ingest Linux endpoint telemetry into a centralized analytics platform and baseline normal ABRT process behavior
Correlate mount table changes made by unprivileged users with subsequent ABRT crash-handling activity
Alert on any root-level command execution whose parent chain includes ABRT after applying the patch, since such events should be rare

How to Mitigate CVE-2025-12744

Immediate Actions Required

Apply vendor-supplied ABRT updates as soon as they are available through your distribution
Restrict local shell access on multi-user systems to trusted accounts only
Disable or mask the ABRT service on hosts where crash reporting is not required until patches are deployed
Review recent ABRT crash reports and audit logs for signs of exploitation attempts

Patch Information

Refer to the Red Hat CVE-2025-12744 Advisory for fixed package versions and errata identifiers. Apply updates through the standard package manager, for example dnf update abrt on Red Hat Enterprise Linux and its derivatives, and restart the ABRT service after installation.

Workarounds

Stop and disable the ABRT daemon with systemctl disable --now abrtd abrt-journal-core abrt-oops until a patched package is installed
Remove or restrict execution of the ABRT container-inspection helper so that docker inspect is not invoked with untrusted input
Constrain the ability of unprivileged users to create arbitrary mounts, for example by tightening fstab and user namespace policies

bash

# Temporary mitigation: disable ABRT services until patched packages are applied
sudo systemctl stop abrtd abrt-journal-core abrt-oops abrt-xorg
sudo systemctl disable abrtd abrt-journal-core abrt-oops abrt-xorg
sudo systemctl mask abrtd

# Verify the daemon is no longer running as root
ps -ef | grep -i abrt