CVE-2025-12744

A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-12744
https://bugzilla.redhat.com/show_bug.cgi?id=2412467

Configurations

No configuration.

History

18 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en el manejo por parte del demonio ABRT de información de montaje proporcionada por el usuario. ABRT copia hasta 12 caracteres de una entrada no confiable y los coloca directamente en un comando de shell (docker inspect %s) sin la validación adecuada. Un usuario local sin privilegios puede elaborar una carga útil que inyecta metacaracteres de shell, lo que provoca que el proceso ABRT que se ejecuta como root ejecute comandos controlados por el atacante y, en última instancia, obtenga privilegios de root completos.

Information

Published : 2025-12-03 09:15

Updated : 2026-10-18 17:10

NVD link : CVE-2025-12744

Mitre link : CVE-2025-12744

CVE.ORG link : CVE-2025-12744

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-12744", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12744", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-03T14:21:48.241054Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "patrick@puiterwijk.org", "affectedData": [{"versions": [{"status": "affected", "version": "0", "lessThan": "2.17.7", "versionType": "semver"}], "packageName": "abrt", "collectionURL": "https://github.com/abrt/abrt", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "abrt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "abrt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "abrt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2025-12-03T09:15:46.390", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-12744", "source": "patrick@puiterwijk.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2412467", "source": "patrick@puiterwijk.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the ABRT daemon\u2019s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el manejo por parte del demonio ABRT de informaci\u00f3n de montaje proporcionada por el usuario. ABRT copia hasta 12 caracteres de una entrada no confiable y los coloca directamente en un comando de shell (docker inspect %s) sin la validaci\u00f3n adecuada. Un usuario local sin privilegios puede elaborar una carga \u00fatil que inyecta metacaracteres de shell, lo que provoca que el proceso ABRT que se ejecuta como root ejecute comandos controlados por el atacante y, en \u00faltima instancia, obtenga privilegios de root completos."}], "lastModified": "2026-10-18T17:10:00.110", "sourceIdentifier": "patrick@puiterwijk.org"}