It was reported that execmod and execstack setroubleshoot plugins use commands.getstatusoutput("... %s ...") which can be misused in such a way when appropriate setroubleshoot plugin analyzes the AVC triggered by binary, setroubleshoot daemon executes arbitrary commands which are part of the binary filename.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1332411

It was discovered that the allowexecstack setroubleshoot plugin executes external commands using the commands.getoutput() without properly sanitizing untrusted inputs used as command arguments. These inputs originated from SELinux AVC messages. A local user could use this flaw to execute arbitrary code as root if they could trigger an SELinux execstack denial using a file with a specially crafted name.

The similar problem was reported for allowexecmod plugin too, related to the use of commands.getstatusoutput(), see bug 1339183.

It was discovered that setroubleshoot executed external commands using subprocess.checkoutput(), commands.getstatusoutput(), or commands.getoutput() without properly sanitizing untrusted inputs used as command arguments. These inputs originated from SELinux AVC messages. A local user could use this flaw to execute arbitrary code as root if they could trigger an SELinux denial using a file with a specially crafted name.

The following cases were identified:

- settpath() in auditdata.py - When executing locate command, it used subprocess.checkoutput() (new setroubleshoot versions) or commands.getstatusoutput() (older versions) to execute command using shell. A local user could use this flaw to execute commands with setroubleshootd privileges.

- runfix() in SetroubleshootFixit.py - This DBus service requires administrative authentication by default. There are currently no known attacks that can be used by non-administrative users.

It was discovered that sealert executed external fix commands using commands.getstatusoutput() without properly sanitizing untrusted inputs used as command arguments. These inputs originated from SELinux AVC messages. A local user could use this flaw to execute arbitrary code as root if they could trigger an SELinux denial using a file with a specially crafted name.

The use of commands.getstatusoutput() was already removed upstream via the following commit:

https://github.com/fedora-selinux/setroubleshoot/commit/2d12677629ca319310f6263688bb1b7f676c01b7