Home

CVE-2018-1063

Description

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Risk Information

Base Score
4.4
MODERATE
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score
Exploitation Probability
0.117

Associated Vulnerability

VulnerabilityOS Platform
(RHSA-2018:0913) Low: policycoreutils security, bug fix, and enhancement update policycoreutils-2.5-22.el7.x86_64.rpmLinux
(RHSA-2018:0913) Low: policycoreutils security, bug fix, and enhancement update policycoreutils-devel-2.5-22.el7.i686.rpmLinux
(RHSA-2018:0913) Low: policycoreutils security, bug fix, and enhancement update policycoreutils-devel-2.5-22.el7.x86_64.rpmLinux
(RHSA-2018:0913) Low: policycoreutils security, bug fix, and enhancement update policycoreutils-gui-2.5-22.el7.x86_64.rpmLinux
(RHSA-2018:0913) Low: policycoreutils security, bug fix, and enhancement update policycoreutils-newrole-2.5-22.el7.x86_64.rpmLinux
(RHSA-2018:0913) Low: policycoreutils security, bug fix, and enhancement update policycoreutils-python-2.5-22.el7.x86_64.rpmLinux
(RHSA-2018:0913) Low: policycoreutils security, bug fix, and enhancement update policycoreutils-restorecond-2.5-22.el7.x86_64.rpmLinux
(RHSA-2018:0913) Low: policycoreutils security, bug fix, and enhancement update policycoreutils-sandbox-2.5-22.el7.x86_64.rpmLinux
SUSE-SU-2018:0926-1(SUSE Linux Enterprise Server 12-SP2 ) policycoreutils-2.5-10.3.1.x86_64.rpmLinux
SUSE-SU-2018:0926-1(SUSE Linux Enterprise Server 12-SP2 ) policycoreutils-debuginfo-2.5-10.3.1.x86_64.rpmLinux
SUSE-SU-2018:0926-1(SUSE Linux Enterprise Server 12-SP2 ) policycoreutils-debugsource-2.5-10.3.1.x86_64.rpmLinux
SUSE-SU-2018:0926-1(SUSE Linux Enterprise Server 12-SP2 ) policycoreutils-python-2.5-10.3.1.x86_64.rpmLinux
SUSE-SU-2018:0926-1(SUSE Linux Enterprise Server 12-SP2 ) policycoreutils-python-debuginfo-2.5-10.3.1.x86_64.rpmLinux
SUSE-SU-2018:0927-1(SUSE Linux Enterprise Server 11-SP4 ) policycoreutils-2.0.79-4.9.3.3.x86_64.rpmLinux
(RHSA-2018:0913)Low: security, bug fix, and enhancement update policycoreutils-debuginfo-2.5-22.el7.i686.rpmLinux
(RHSA-2018:0913)Low: security, bug fix, and enhancement update policycoreutils-debuginfo-2.5-22.el7.x86_64.rpmLinux
policycoreutils Security Update (ALAS-2018-1076) policycoreutils-2.5-22.amzn2.x86_64.rpmLinux
policycoreutils Security Update (ALAS-2018-1076) policycoreutils-gui-2.5-22.amzn2.x86_64.rpmLinux
policycoreutils Security Update (ALAS-2018-1076) policycoreutils-devel-2.5-22.amzn2.x86_64.rpmLinux
policycoreutils Security Update (ALAS-2018-1076) policycoreutils-python-2.5-22.amzn2.x86_64.rpmLinux
policycoreutils Security Update (ALAS-2018-1076) policycoreutils-newrole-2.5-22.amzn2.x86_64.rpmLinux
policycoreutils Security Update (ALAS-2018-1076) policycoreutils-sandbox-2.5-22.amzn2.x86_64.rpmLinux
policycoreutils Security Update (ALAS-2018-1076) policycoreutils-restorecond-2.5-22.amzn2.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234