CVE-2016-4446: Command Injection
It was discovered that the allowexecstack setroubleshoot plugin executes external commands using the commands.getoutput() without properly sanitizing untrusted inputs used as command arguments. These inputs originated from SELinux AVC messages. A local user could use this flaw to execute arbitrary code as root if they could trigger an SELinux execstack denial using a file with a specially crafted name.
The similar problem was reported for allowexecmod plugin too, related to the use of commands.getstatusoutput(), see bug 1339183.
Other sources
The allowexecstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename, related to the commands.getoutput function.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4446?
CVE-2016-4446 is considered a high severity vulnerability that allows local users to execute arbitrary commands.
How do I fix CVE-2016-4446?
To mitigate CVE-2016-4446, update the setroubleshoot-plugins package to version 3.2.27.1 or 3.3.9.1 or later.
What systems are affected by CVE-2016-4446?
CVE-2016-4446 affects Red Hat Enterprise Linux Desktop, HPC Node, Server, and Workstation running versions 7.0 and earlier.
What is the exploit vector for CVE-2016-4446?
The exploit vector for CVE-2016-4446 involves triggering an execstack SELinux denial using a specifically crafted filename.
Who can be affected by CVE-2016-4446?
Local users with access to the affected systems can exploit CVE-2016-4446 to execute arbitrary commands.