Alibaba Cloud Linux 3 : 0262: abrt (ALINUX3-SA-2026:0262)

high Nessus Plugin ID 342088

Synopsis

The remote Alibaba Cloud Linux host is missing one or more security updates.

Description

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0262 advisory.

Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

CVE-2026-54228:
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

CVE-2026-54229:
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.

CVE-2026-54230:
A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport.
Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.

CVE-2026-54231:
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport.
The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 342088

File Name: alinux3_sa_2026-0262.nasl

Version: 1.1

Type: Local

Family: Alibaba Cloud Linux Local Security Checks

Published: 9/1/2026

Updated: 9/1/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.17

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-54230

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:alibabacloud:alibaba_cloud_linux_3, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-addon-ccpp, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-addon-coredump-helper, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-addon-kerneloops, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-addon-pstoreoops, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-addon-vmcore, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-addon-xorg, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-cli-ng, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-cli, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-console-notification, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-dbus, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-desktop, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-gui-libs, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-gui, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-libs, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-plugin-machine-id, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-retrace-client, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt-tui, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:abrt, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:python3-abrt-addon, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:python3-abrt-container-addon, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:python3-abrt-doc, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:python3-abrt

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Alibaba/release, Host/Alibaba/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/28/2026

Vulnerability Publication Date: 6/13/2026

Reference Information

CVE: CVE-2026-54228, CVE-2026-54229, CVE-2026-54230, CVE-2026-54231

Detections

Analytics