CVE-2025-12744: 
Rocky Linux vulnerability analysis and mitigation

CVE-2025-12744 is an OS command injection vulnerability in the ABRT (Automatic Bug Reporting Tool) daemon that allows an unprivileged local user to escalate privileges to root. The flaw was reported on November 5, 2025, and publicly disclosed on December 3, 2025. It affects ABRT as shipped with Red Hat Enterprise Linux 8 (multiple update streams) and Fedora 41/42. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). ABRT extracts up to 12 bytes from user-controlled mount information (e.g., /proc/self/mountinfo) and embeds the value verbatim into a shell command constructed via g_strdup_printf("docker inspect %s", container_id), which is then passed to a shell invocation without any sanitization. Because the ABRT daemon runs as root and exposes a UNIX socket, any local user with access to that socket can craft a mountinfo value containing shell metacharacters (e.g., ;, $(), &&) to inject and execute arbitrary commands as root, also escaping systemd sandboxing. A public proof-of-concept exploit is available at GitHub PoC, and a detailed write-up was published at initblog (Red Hat Bugzilla, Feedly).

Successful exploitation grants the attacker full root privileges on the affected system, resulting in complete compromise of confidentiality, integrity, and availability. The attacker can read all files, modify system configuration, install backdoors, and escape systemd sandboxing, enabling lateral movement within the environment. No user interaction is required, and the attack requires only low-privilege local access (Red Hat Bugzilla, Feedly).

A public proof-of-concept exploit is available on GitHub (GitHub PoC) and has also been published to Exploit-DB (EDB-52515). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.02% (very low probability of near-term exploitation), and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is detectable by Nessus and Qualys scanners (Feedly).

1. Reconnaissance: Identify a target Linux system (RHEL 8, Fedora 41/42) running the ABRT daemon (abrtd) as root with an accessible UNIX socket (typically /var/run/abrt/abrt.socket).
2. Craft malicious mountinfo: Prepare a payload that injects shell metacharacters into a string of up to 12 characters — for example, a container ID field in /proc/self/mountinfo containing a value like `cmd` or $(cmd) that will be interpreted by the shell.
3. Trigger ABRT container data handling: Interact with the ABRT UNIX socket or trigger a crash report that causes ABRT to read the attacker-controlled mountinfo value and extract the 12-byte container ID substring.
4. Command injection: ABRT constructs the shell command docker inspect <attacker_payload> using g_strdup_printf and passes it to a shell. The injected metacharacters cause the shell to execute the attacker's arbitrary command as root.
5. Privilege escalation: The attacker's payload (e.g., adding a user to /etc/sudoers, writing an SSH key, or spawning a root shell) executes with full root privileges, achieving complete system compromise and escaping systemd sandboxing (GitHub PoC, initblog, Red Hat Bugzilla).

• Process: Unexpected child processes spawned by abrtd (e.g., /bin/bash, sh, python, curl, wget, nc) visible in process trees.
• Logs: Entries in /var/log/abrt/ or systemd journal (journalctl -u abrtd) showing unusual docker inspect invocations with non-standard container ID strings containing shell metacharacters.
• File System: New or modified files in /etc/sudoers.d/, /root/.ssh/authorized_keys, or unexpected SUID binaries created around the time of ABRT activity.
• Network: Unexpected outbound connections from the host originating from the abrtd process or its children, particularly to external IPs.
• UNIX Socket: Unusual or high-frequency connections to /var/run/abrt/abrt.socket from non-privileged user processes (GitHub PoC, Red Hat Bugzilla).

Red Hat has released patches via multiple errata: RHSA-2025:22760 (RHEL 8), RHSA-2025:23030 (RHEL 8.8 SAP/TUS), RHSA-2025:23031 (RHEL 8.2 AUS), RHSA-2025:23032 (RHEL 8.6 AUS/SAP/TUS), and RHSA-2025:23033 (RHEL 8.4 AUS/EUS). Fedora 41 and 42 updates have also been issued. As an immediate workaround where patching is not possible, disable or stop the ABRT daemon (systemctl stop abrtd && systemctl disable abrtd) and restrict access to the ABRT UNIX socket. Applying vendor patches is the recommended long-term remediation (Red Hat Bugzilla, Red Hat CVE).

The vulnerability was covered by Linux security news outlets including LinuxSecurity.com (for both Fedora 41 and 42 advisories) and pro-linux.de, which published multiple advisories on the privilege escalation issue. The researcher who discovered and published the PoC documented the exploit technique in detail on their blog (initblog). CISA included the vulnerability in its weekly vulnerability bulletin (SB25-342). Community discussion was noted on Telegram security intelligence channels.