CVE-2016-4989 setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by....
HighCVSS 7.0
EPSS 0.46%
- Published
- Updated
- Exploit status
- No public exploit known
Description
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| setroubleshoot project setroubleshoot | <= - | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- [oss-security] 20160621 SELinux troubles mailing-list third-party-advisory
- 1036144 patch third-party-advisory vdb-entry
- RHSA-2016:1293 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking
- github.com patch
- github.com patch
- RHSA-2016:1267 third-party-advisory vendor-advisory