CVE-2025-68733: smack: fix bug: unprivileged task can create labels
In the Linux kernel, the following vulnerability has been resolved:
smack: fix bug: unprivileged task can create labels
If an unprivileged task is allowed to relabel itself (/smack/relabel-self is not empty), it can freely create new labels by writing their names into own /proc/PID/attr/smack/current
This occurs because dosetattr() imports the provided label in advance, before checking "relabel-self" list.
This change ensures that the "relabel-self" list is checked before importing the label.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68733?
The severity of CVE-2025-68733 is classified as a high-risk vulnerability due to the potential for unprivileged tasks to create arbitrary labels.
How do I fix CVE-2025-68733?
To fix CVE-2025-68733, it is recommended to update to the latest version of the Linux kernel where this vulnerability has been patched.
What systems are affected by CVE-2025-68733?
CVE-2025-68733 affects various versions of the Linux kernel that allow unprivileged tasks to relabel themselves.
What type of vulnerability is CVE-2025-68733?
CVE-2025-68733 is a vulnerability in the Linux kernel related to security label creation by unprivileged tasks.
What can attackers do with CVE-2025-68733?
Attackers exploiting CVE-2025-68733 can create new security labels, potentially compromising system integrity and security policies.