CVE-2016-4989: Command Injection
It was discovered that setroubleshoot executed external commands using subprocess.checkoutput(), commands.getstatusoutput(), or commands.getoutput() without properly sanitizing untrusted inputs used as command arguments. These inputs originated from SELinux AVC messages. A local user could use this flaw to execute arbitrary code as root if they could trigger an SELinux denial using a file with a specially crafted name.
The following cases were identified:
- settpath() in auditdata.py - When executing locate command, it used subprocess.checkoutput() (new setroubleshoot versions) or commands.getstatusoutput() (older versions) to execute command using shell. A local user could use this flaw to execute commands with setroubleshootd privileges.
- runfix() in SetroubleshootFixit.py - This DBus service requires administrative authentication by default. There are currently no known attacks that can be used by non-administrative users.
Other sources
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the settpath function in auditdata.py or via a crafted (2) localid or (3) analysisid field in a crafted XML document to the runfix function in SetroubleshootFixit.py, related to the subprocess.checkoutput and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability description for CVE-2016-4989?
CVE-2016-4989 allows local users to bypass an intended container protection mechanism and execute arbitrary commands through specific crafted file names and fields.
What are the affected versions for CVE-2016-4989?
CVE-2016-4989 affects setroubleshoot versions prior to 3.2.27.1 and 3.3.9.1.
What systems are primarily impacted by CVE-2016-4989?
CVE-2016-4989 impacts Red Hat Enterprise Linux Desktop, Server, Workstation, and HPC Node version 7.0.
How do I fix CVE-2016-4989?
To fix CVE-2016-4989, update setroubleshoot to version 3.2.27.1 or 3.3.9.1 or later.
What kind of exploit does CVE-2016-4989 represent?
CVE-2016-4989 represents a local privilege escalation vulnerability through command execution.