A TOCTOU race condition exists in the SetElement method of the abrt-dbus D-Bus service in Red Hat Enterprise Linux 7 Extended Lifecycle Support. Between the creation of a dump directory and the execution of a post-create event, a local user can invoke SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation. This allows crashes of unpackaged binaries to survive post-create processing. The vulnerability affects ABRT, which is deprecated in RHEL 8 and absent in RHEL 9 or later. Red Hat has issued a security advisory and released updated packages for RHEL 8.6 Extended Update Support to address this issue. The CVSS v3.1 score is 7.8 (High), reflecting local attack vector, low complexity, low privileges required, and high impact on confidentiality, integrity, and availability. Mitigations include disabling or removing ABRT and restricting local user access. The vendor advisory provides detailed remediation instructions and encourages migration to systemd-coredump on Fedora systems.

The vulnerability allows a local attacker with low privileges to write arbitrary files into a root-owned dump directory by exploiting a race condition in ABRT's abrt-dbus service. This bypasses package validation and permits crashes of unpackaged binaries to survive post-create processing, potentially leading to unauthorized file writes, modification of application data, hiding of malicious activities, and disruption of system stability. The impact is rated high for confidentiality, integrity, and availability.

Red Hat has released an official security update fixing this vulnerability in Red Hat Enterprise Linux 8.6 Extended Update Support. Users should apply the available update (abrt-2.10.9-25.el8_6.1 and related packages) as soon as possible. For RHEL 8 systems where ABRT is installed, disabling or removing ABRT is recommended if it is not required, using commands such as 'systemctl disable --now abrtd.service abrt-journal-core.service abrt-oops.service abrt-xorg.service'. Fedora users should consider migrating to systemd-coredump instead of ABRT. Additionally, restricting local user access to systems running ABRT reduces exposure, as exploitation requires local access. No further action is required once the update is applied or ABRT is disabled.