CVE-2026-23740: Asterisk ast_coredumper RCE Vulnerability

CVE-2026-23740 Overview

CVE-2026-23740 is a local privilege escalation vulnerability in Asterisk, the widely-deployed open source private branch exchange (PBX) and telephony toolkit. The vulnerability exists in the ast_coredumper utility, which writes its gdb initialization and output files to world-writable directories such as /tmp. An attacker with local write permissions to these directories can manipulate the gdb init file and output paths to force root to execute arbitrary commands or overwrite arbitrary system files.

Critical Impact

Local attackers can achieve root-level arbitrary command execution or file overwrite on systems running vulnerable Asterisk versions by exploiting insecure file handling in the ast_coredumper utility.

Affected Products

• Sangoma Certified Asterisk versions prior to 20.7-cert9
• Sangoma Asterisk versions prior to 20.18.2, 21.12.1, 22.8.2, and 23.2.2
• Legacy Certified Asterisk versions including 13.13.0, 16.8.x, and 18.9.x series

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-23740 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-23740

Vulnerability Analysis

This vulnerability is classified as CWE-427 (Uncontrolled Search Path Element), which occurs when the application uses a search path that can be controlled by untrusted actors. In this case, the ast_coredumper script writes temporary files to world-writable directories without proper safeguards against path manipulation.

The core issue stems from the utility's handling of gdb initialization files and output paths. When ast_coredumper is executed with root privileges to analyze a core dump, it creates and reads files from directories accessible to all system users. Since /tmp and similar world-writable directories allow any user to create, modify, or delete files, an attacker can preemptively place malicious content in the expected file locations.

The attack requires local access to the system, but critically, any authenticated user on a standard Linux system has the necessary write permissions to the target directory. This significantly lowers the barrier for exploitation in multi-user environments or systems with any form of shell access.

Root Cause

The root cause is the insecure use of world-writable directories for sensitive operations performed by a privileged process. The ast_coredumper utility fails to implement proper file handling safeguards such as:

• Using secure temporary file creation with restrictive permissions
• Validating file ownership and permissions before reading configuration
• Employing private directories with appropriate access controls
• Implementing integrity checks on initialization files

This design flaw allows unprivileged users to inject malicious content into files that the root process subsequently trusts and executes.

Attack Vector

The attack leverages local access to exploit the race condition between file creation and file usage by the privileged ast_coredumper process. An attacker can prepare malicious gdb commands in a file at the expected path location before the core dump analysis occurs.

When the ast_coredumper utility runs as root to analyze a crash, it reads the attacker-controlled gdb init file, which can contain arbitrary gdb commands including shell command execution. Alternatively, the attacker can manipulate output paths to cause the root process to overwrite sensitive system files such as /etc/passwd, /etc/shadow, or cron configurations.

The exploitation scenario involves creating or modifying files in /tmp (or another configured world-writable directory) with content that will be interpreted by gdb when ast_coredumper executes. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-23740

Indicators of Compromise

• Unexpected files appearing in /tmp with names matching ast_coredumper patterns before crash events
• Modification of system files with timestamps correlating to ast_coredumper execution
• Suspicious gdb-related files in world-writable directories owned by non-root users
• Unauthorized changes to cron jobs, system binaries, or authentication files following Asterisk crashes

Detection Strategies

• Monitor file creation events in /tmp and other world-writable directories for patterns associated with ast_coredumper operations
• Implement file integrity monitoring (FIM) on critical system files to detect unauthorized modifications
• Audit ast_coredumper process execution and correlate with file system activity
• Review authentication logs for privilege escalation attempts following Asterisk-related events

Monitoring Recommendations

• Configure auditd rules to track file operations in /tmp by the asterisk user and root processes
• Deploy endpoint detection to alert on unexpected command execution originating from gdb processes
• Establish baseline monitoring for ast_coredumper usage patterns and alert on anomalies
• Implement SentinelOne's behavioral AI to detect privilege escalation attempts through unconventional execution chains

How to Mitigate CVE-2026-23740

Immediate Actions Required

• Upgrade Sangoma Certified Asterisk to version 20.7-cert9 or later immediately
• Upgrade Sangoma Asterisk to versions 20.18.2, 21.12.1, 22.8.2, or 23.2.2 depending on your branch
• Restrict access to the ast_coredumper utility to only authorized administrators
• Review system logs for any indicators of prior exploitation attempts

Patch Information

Sangoma has released patched versions that address this vulnerability by implementing secure file handling practices. The fix ensures that ast_coredumper no longer writes sensitive files to world-writable directories without proper safeguards. Organizations should upgrade to the following patched versions:

For additional details, consult the GitHub Security Advisory.

Workarounds

• Configure ast_coredumper to use a non-world-writable directory with restrictive permissions (e.g., /var/lib/asterisk/coredumps)
• Remove execute permissions on ast_coredumper if crash dump analysis is not required in your environment
• Implement mandatory access control (SELinux/AppArmor) policies to restrict ast_coredumper file operations
• Limit local shell access on Asterisk servers to reduce the attack surface

# Create secure directory for ast_coredumper with restricted permissions
mkdir -p /var/lib/asterisk/coredumps
chown root:asterisk /var/lib/asterisk/coredumps
chmod 750 /var/lib/asterisk/coredumps

# Optionally disable ast_coredumper if not needed
chmod 000 /usr/sbin/ast_coredumper