This vulnerability arises from ABRT event handler scripts writing output files using shell redirections without the O_NOFOLLOW flag, allowing a symlink to be followed and arbitrary files to be overwritten by the root process. It affects Red Hat Enterprise Linux 8 systems with ABRT installed and Fedora 43 and 44 where ABRT is still shipped. The vulnerability is tracked as CWE-59 (Improper Link Resolution Before File Access). Red Hat has issued an important security advisory with updated packages that fix this issue. Mitigations include disabling or removing ABRT and restricting local user access. The vulnerability has a CVSS v3.1 score of 7.0 (high severity) with local attack vector, high attack complexity, low privileges required, and impacts confidentiality, integrity, and availability.

An attacker with local access and low privileges can exploit this vulnerability to overwrite arbitrary files on the system with root privileges by leveraging symlink following in ABRT event handler scripts. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The vulnerability does not require user interaction but has high attack complexity. It affects systems running ABRT on Red Hat Enterprise Linux 8 and certain Fedora versions.

Red Hat has released security updates that fix this vulnerability in ABRT packages for Red Hat Enterprise Linux 8. Users should apply these updates promptly. Additionally, Red Hat recommends disabling or removing ABRT if it is not required (e.g., using 'systemctl disable --now abrtd.service' and related services). On Fedora systems, consider using systemd-coredump instead of ABRT for crash handling. Restricting local user access to systems running ABRT also mitigates exposure since the vulnerability requires local access. The vendor advisory provides official fixes and detailed instructions.