Junglewise Threat Intelligence

CVE-2016-7545: SELinux policycoreutils sandbox escape via TIOCSTI ioctl injection

CVE-2016-7545 · Severity: high · CVSS 8.8 · Published 2017-01-19

Technologies: Red Hat Enterprise Linux. Vendors: Red Hat.

Executive brief

A vulnerability in the SELinux sandbox tool allows a local user to break out of their restricted environment. By running a specially crafted program within the sandbox, an attacker can execute unauthorized commands in the context of the parent shell. This could lead to a full compromise of the host system by bypassing intended security boundaries.

Technical details

The sandbox tool in SELinux policycoreutils is vulnerable to a TIOCSTI ioctl injection attack. A local attacker can execute a malicious program inside the sandbox that uses the TIOCSTI ioctl to push characters into the input buffer of the parent terminal (the controlling tty). This allows the attacker to execute arbitrary commands in the context of the parent shell once the sandbox process terminates, effectively bypassing the SELinux sandbox isolation. The issue is addressed by patches that prevent the sandboxed process from accessing the terminal's ioctl interface or by using setsid() to break the tty association.

Affected products

  • Red Hat Enterprise Linux 6, 7
  • Fedora Project Fedora 25
  • SELinux Project policycoreutils

Timeline

  • 2016-09-25: disclosed: Public discussion on oss-security mailing list
  • 2016-11-14: patched: Red Hat released initial security updates (RHSA-2016:2702)
  • 2017-01-19: advisory: NVD publication date

References