CVE-2018-1063

NameCVE-2018-1063
DescriptionContext relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
policycoreutils (PTS)jessie2.3-1vulnerable
stretch2.6-3vulnerable
buster2.8-1fixed
bullseye3.1-3fixed
bookworm3.4-1fixed
sid, trixie3.5-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
policycoreutilssource(unstable)2.7-1

Notes

[stretch] - policycoreutils <no-dsa> (Minor issue)
[jessie] - policycoreutils <no-dsa> (Minor issue)
[wheezy] - policycoreutils <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=1550122
Mitigation by removing any symbolic link in /tmp and /var/tmp directories
before relabeling the file system. Futhtermore only triggerable at
relabeling time.
https://github.com/SELinuxProject/selinux/commit/2608b4d6660af0fb8ad93f2cc144bdaab3c2afa8

Search for package or bug name: Reporting problems