This vulnerability exists in the ABRT post-create event handler scripts in libreport, which query the systemd journal for log entries related to crashed processes and write these to files in the dump directory. The scripts do not sanitize embedded control characters, allowing a local user to inject arbitrary content by embedding newline characters in syslog messages. This can control the content that root writes to dump directory files, impacting data integrity. The vulnerability has a CVSS 3.1 score of 5.5 (medium severity) with local attack vector, low complexity, and low privileges required. Red Hat has acknowledged the issue and released an update for RHEL 8. ABRT is deprecated and users are encouraged to disable or remove it if not required.

A local user with the ability to write syslog messages can inject arbitrary content into files created by root in the dump directory, potentially altering the integrity of these files. There is no confidentiality or availability impact reported. The vulnerability requires local access and low privileges. It does not affect Red Hat Enterprise Linux 9 or later, where ABRT is not available.

Red Hat recommends disabling or removing ABRT on RHEL 8 systems if it is not required. This can be done by disabling the abrtd and related services using systemctl. Fedora users should consider using systemd-coredump instead of ABRT. Restricting local user access to systems running ABRT can also mitigate risk. A security update fixing this vulnerability is available for Red Hat Enterprise Linux 8 and should be applied promptly.