Executive brief
A security flaw was found in a component of the SELinux sandbox utility, which is used to run untrusted programs in a restricted environment. If this utility is configured with administrative privileges (setuid-root), a local user can exploit a timing issue to trick the system into deleting important system files owned by the root user. This could lead to a total system failure or a denial-of-service condition, though it does not directly allow the attacker to read private user data.
Technical details
A Time-of-check Time-of-use (TOCTOU) race condition exists in the rm_rf() function of the seunshare utility. The vulnerability occurs because the openat() system call used during recursive directory removal lacks the O_NOFOLLOW flag, allowing a local attacker to replace a directory with a symbolic link between the initial check and the subsequent deletion. While the process drops capabilities before this operation, it retains a filesystem UID of 0, allowing it to delete root-owned files. This is particularly impactful on systems where the user runs in an unconfined SELinux domain, as there is no policy transition to restrict the setuid-root binary's actions. The issue is fixed in policycoreutils version 3.11.
Affected products
- SELinuxProject policycoreutils through 3.10
Timeline
- 2026-06-15: other: Initial security review initiated by SUSE.
- 2026-07-02: patched: Upstream release 3.11 fixes the issue.
- 2026-07-15: advisory: SUSE Security Team publishes detailed blog post.
- 2026-07-23: disclosed: CVE-2026-59676 is published.