It was discovered that setroubleshoot executed external commands using subprocess.checkoutput(), commands.getstatusoutput(), or commands.getoutput() without properly sanitizing untrusted inputs used as command arguments. These inputs originated from SELinux AVC messages. A local user could use this flaw to execute arbitrary code as root if they could trigger an SELinux denial using a file with a specially crafted name.

The following cases were identified:

- settpath() in auditdata.py - When executing locate command, it used subprocess.checkoutput() (new setroubleshoot versions) or commands.getstatusoutput() (older versions) to execute command using shell. A local user could use this flaw to execute commands with setroubleshootd privileges.

- runfix() in SetroubleshootFixit.py - This DBus service requires administrative authentication by default. There are currently no known attacks that can be used by non-administrative users.

It was discovered that the allowexecstack setroubleshoot plugin executes external commands using the commands.getoutput() without properly sanitizing untrusted inputs used as command arguments. These inputs originated from SELinux AVC messages. A local user could use this flaw to execute arbitrary code as root if they could trigger an SELinux execstack denial using a file with a specially crafted name.

The similar problem was reported for allowexecmod plugin too, related to the use of commands.getstatusoutput(), see bug 1339183.