CVE-2016-4445: Command Injection
It was discovered that sealert executed external fix commands using commands.getstatusoutput() without properly sanitizing untrusted inputs used as command arguments. These inputs originated from SELinux AVC messages. A local user could use this flaw to execute arbitrary code as root if they could trigger an SELinux denial using a file with a specially crafted name.
The use of commands.getstatusoutput() was already removed upstream via the following commit:
https://github.com/fedora-selinux/setroubleshoot/commit/2d12677629ca319310f6263688bb1b7f676c01b7
Other sources
The fixlookupid function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4445?
CVE-2016-4445 has a medium severity rating as it allows local users to execute arbitrary commands as root.
How do I fix CVE-2016-4445?
To fix CVE-2016-4445, update the setroubleshoot package to version 3.2.23 or later.
Which software is affected by CVE-2016-4445?
CVE-2016-4445 affects versions of setroubleshoot prior to 3.2.23 and specific distributions of Red Hat Enterprise Linux 7.0.
What is the exploit method for CVE-2016-4445?
CVE-2016-4445 can be exploited by triggering an SELinux denial with a crafted file name.
Is CVE-2016-4445 fixed in later versions of setroubleshoot?
Yes, CVE-2016-4445 is fixed in setroubleshoot version 3.2.23 and subsequent releases.