CVE-2026-23740
Description
A flaw was found in Asterisk. When the ast_coredumper writes its gdb init and output files to a world-writable directory, a local attacker with write permissions to that directory can exploit this vulnerability. By manipulating the gdb init file and output paths, the attacker can cause the system to execute arbitrary commands as root or overwrite arbitrary files, leading to privilege escalation and potential system compromise.
Statement
This IMPORTANT vulnerability in Asterisk allows a local attacker to achieve privilege escalation. When the ast_coredumper writes to a world-writable directory, such as /tmp, a local user can manipulate the GDB init and output files. This manipulation can lead to the execution of arbitrary commands as root or the overwriting of arbitrary files. This affects Asterisk packages in Red Hat Community Projects, including EPEL 8, EPEL 9, Fedora 42, and Fedora 43.
Mitigation
To mitigate this vulnerability, configure Asterisk's ast_coredumper to write its gdb initialization and output files to a directory with restricted permissions, preventing unprivileged users from modifying them. Ensure the chosen directory is not world-writable. Consult Asterisk documentation for specific configuration parameters related to ast_coredumper output paths. A restart of the Asterisk service may be required for changes to take effect.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Since the file is visible and the application which is using the temp file could be known, the attacker has gained information about what the user is doing at that time.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
