From 8085b4f1dfbee20df6276fbb0857f04b1c87ad29 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Fri, 7 Aug 2026 12:53:30 +0200 Subject: [PATCH 1/5] Fix race condition in ChownProblemDir Resolves: CVE-2026-54229 A local attacker could call ChownProblemDir while post-create event handlers are still processing a dump directory, seizing file ownership while privileged scripts continue writing and processing those files. Co-Authored-By: Claude Opus 4.6 --- src/dbus/abrt-dbus.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/dbus/abrt-dbus.c b/src/dbus/abrt-dbus.c index e68bce8..d152f8e 100644 --- a/src/dbus/abrt-dbus.c +++ b/src/dbus/abrt-dbus.c @@ -499,6 +499,15 @@ static void handle_method_call(GDBusConnection *connection, return; } + if (!problem_dump_dir_is_complete(dd)) + { + g_dbus_method_invocation_return_dbus_error(invocation, + "org.freedesktop.problems.InvalidProblemDir", + _("Problem directory is being processed")); + dd_close(dd); + return; + } + int chown_res = dd_chown(dd, caller_uid); if (chown_res != 0) g_dbus_method_invocation_return_dbus_error(invocation, -- 2.55.0