Red Hat Bugzilla – Bug 1346461
CVE-2016-4989 setroubleshoot: command injection issues
Last modified: 2016-06-23 06:55:56 EDT
It was discovered that setroubleshoot executed external commands using subprocess.check_output(), commands.getstatusoutput(), or commands.getoutput() without properly sanitizing untrusted inputs used as command arguments. These inputs originated from SELinux AVC messages. A local user could use this flaw to execute arbitrary code as root if they could trigger an SELinux denial using a file with a specially crafted name. The following cases were identified: - _set_tpath() in audit_data.py - When executing locate command, it used subprocess.check_output() (new setroubleshoot versions) or commands.getstatusoutput() (older versions) to execute command using shell. A local user could use this flaw to execute commands with setroubleshootd privileges. - run_fix() in SetroubleshootFixit.py - This DBus service requires administrative authentication by default. There are currently no known attacks that can be used by non-administrative users.
Acknowledgments: Name: Red Hat Product Security
Note that this issue was independently reported by Sebastian Krahmer (SuSE Security Team).
The impact of this issue on Red Hat Enterprise Linux 7.2 and later is reduced, as setroubleshootd does not run with root privileges, but with privileges of a dedicated non-root user setroubleshoot. The SetroubleshootFixit service runs with root privileges but, as noted in comment 0, there are currently no known attacks against the service.
Note that this issue was originally handled as part of the CVE-2016-4445 (bug 1339183), but was later split out because of different fixed-in versions.
Public now via: http://seclists.org/oss-sec/2016/q2/574 Sebastian Krahmer's exploit: https://github.com/stealth/troubleshooter/blob/master/straight-shooter.c
Created setroubleshoot tracking bugs for this issue: Affects: fedora-all [bug 1348526]
Upstream commits: https://github.com/fedora-selinux/setroubleshoot/commit/e69378d7e82a503534d29c5939fa219341e8f2ad https://github.com/fedora-selinux/setroubleshoot/commit/dda55aa50db95a25f0d919c3a0d5871827cdc40f
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2016:1267 https://access.redhat.com/errata/RHSA-2016:1267
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:1293 https://access.redhat.com/errata/RHSA-2016:1293