CVE-2026-23740: 
NixOS vulnerability analysis and mitigation

CVE-2026-23740 is a privilege escalation vulnerability in Asterisk, the open-source PBX and telephony toolkit developed by Sangoma. The flaw exists in the ast_coredumper script, which runs as root and writes GDB initialization and output files to world-writable directories such as /tmp, allowing any local user to manipulate those files and cause root to execute arbitrary commands. Affected versions include Asterisk prior to 20.18.2, 21.12.1, 22.8.2, and 23.2.2, as well as Certified Asterisk prior to 20.7-cert9. The vulnerability was published on February 6, 2026. It carries a CVSS v3.1 base score of 7.8 (High) per NVD, though the GitHub Security Advisory rates it as Low with a different vector (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-427 (Uncontrolled Search Path Element). When ast_coredumper executes, it extracts GDB commands from itself and writes them to /tmp/.gdbinit; because /tmp is world-writable on Linux systems, any local user can pre-create or symlink /tmp/.gdbinit to an attacker-controlled file, or race the script to modify the file before GDB executes it with root privileges. GDB initialization files support arbitrary command execution, meaning a malicious .gdbinit can be weaponized to run commands as root. Additionally, the trap 'rm $gdbinit' EXIT cleanup mechanism can be abused to achieve arbitrary file deletion, further enabling privilege escalation (GitHub Advisory).

Successful exploitation allows a local, unprivileged user to escalate privileges to root by causing the ast_coredumper script to execute attacker-controlled GDB commands. This results in high confidentiality, integrity, and availability impact — an attacker can read sensitive files, overwrite arbitrary system files, or execute arbitrary commands as root. The attack is limited to the local system scope but could serve as a stepping stone for broader compromise of the host running Asterisk (GitHub Advisory, Red Hat CVE).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-23740. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the system and user interaction (a privileged user must trigger ast_coredumper), which limits the practical attack surface (GitHub Advisory).

1. Reconnaissance: Confirm the target system runs a vulnerable version of Asterisk (prior to 20.18.2, 21.12.1, 22.8.2, 23.2.2, or Certified Asterisk prior to 20.7-cert9) and that ast_coredumper is present and configured to run as root.
2. Pre-stage malicious file: As a local unprivileged user, create or symlink /tmp/.gdbinit to an attacker-controlled file containing malicious GDB commands (e.g., shell chmod u+s /bin/bash or a reverse shell command).
3. Race condition (alternative): If the file cannot be pre-staged, monitor for ast_coredumper execution and race to overwrite /tmp/.gdbinit with the malicious content before GDB reads it.
4. Trigger execution: Wait for or social-engineer a privileged user (e.g., an administrator) to trigger a core dump analysis using ast_coredumper, which causes root to invoke GDB with the attacker-controlled init file.
5. Achieve privilege escalation: GDB executes the malicious commands as root, granting the attacker elevated privileges or arbitrary file manipulation on the system (GitHub Advisory).

• File System: Unexpected or recently modified /tmp/.gdbinit file; symlinks in /tmp/ pointing to sensitive system files; unusual files created in /tmp/ with GDB command syntax.
• Process: gdb process spawned by root with init file sourced from /tmp/; unexpected child processes of gdb running as root (e.g., /bin/bash, curl, nc).
• Logs: System logs (/var/log/auth.log, /var/log/syslog) showing unexpected privilege escalation events or root shell activity following ast_coredumper execution; audit logs recording writes to /tmp/.gdbinit by non-root users.
• File System: Unexpected SUID/SGID bit changes on system binaries; newly created or modified files owned by root in sensitive directories following ast_coredumper invocation (GitHub Advisory).

Upgrade to patched versions: Asterisk 20.18.2, 21.12.1, 22.8.2, or 23.2.2; Certified Asterisk 20.7-cert9. As a workaround, restrict write access to /tmp for non-root users where operationally feasible, or configure ast_coredumper to write its GDB init and output files to a directory that is not world-writable. Debian LTS users should apply the security update announced via the Debian LTS mailing list (GitHub Advisory, Debian LTS).

Red Hat tracked the vulnerability and published a CVE page, though no specific Red Hat products were listed as affected. Debian issued a Long Term Support (LTS) security announcement (DLA-4515-1) addressing the vulnerability in their asterisk packages. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability database aggregation (Red Hat CVE, Debian LTS).