CVE-2016-4445 The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to exec...
HighCVSS 7.0
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| setroubleshoot project setroubleshoot | <= 3.2.22 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- [oss-security] 20160621 Re: SELinux troubles exploit mailing-list patch third-party-advisory
- 91430 third-party-advisory vdb-entry
- 1036144 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking
- github.com patch
- RHSA-2016:1267 third-party-advisory vendor-advisory