Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade policycoreutilsUpgrade policycoreutils-sandboxUpgrade policycoreutils-pythonUpgrade policycoreutils-develUpgrade policycoreutils-newroleUpgrade policycoreutils-guiUpgrade policycoreutils-restorecondUpgrade policycoreutils-debuginfo | Apr 27, 2020 | Mar 2, 2018 |
| Centos_linux | — | Upgrade policycoreutils-restorecondUpgrade policycoreutils-pythonUpgrade policycoreutils-newroleUpgrade policycoreutils-debuginfoUpgrade policycoreutils-develUpgrade policycoreutils-guiUpgrade policycoreutils-sandboxUpgrade policycoreutils | Aug 28, 2019 | Mar 2, 2018 |
| Debian | — | Upgrade policycoreutils | Jul 30, 2024 | Mar 2, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade policycoreutils-develUpgrade policycoreutils-pythonUpgrade policycoreutils-sandboxUpgrade policycoreutilsUpgrade policycoreutils-newroleUpgrade policycoreutils-gui | Dec 4, 2019 | Mar 2, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade policycoreutils-guiUpgrade policycoreutils-develUpgrade policycoreutils-newroleUpgrade policycoreutilsUpgrade policycoreutils-sandboxUpgrade policycoreutils-python | Apr 16, 2020 | Mar 2, 2018 |
| Oracle_linux | — | Upgrade policycoreutilsUpgrade policycoreutils-newroleUpgrade policycoreutils-sandboxUpgrade policycoreutils-restorecondUpgrade policycoreutils-develUpgrade policycoreutils-pythonUpgrade policycoreutils-gui | Apr 19, 2018 | Feb 28, 2018 |
| Redhat_linux | — | Upgrade policycoreutilsUpgrade policycoreutils-guiUpgrade policycoreutils-newroleUpgrade policycoreutils-restorecondUpgrade policycoreutils-debuginfoUpgrade policycoreutils-sandboxUpgrade policycoreutils-develNo solution existsUpgrade policycoreutils-python | Apr 11, 2018 | Mar 2, 2018 |
| Suse | — | Upgrade policycoreutils-develUpgrade python3-policycoreutilsUpgrade policycoreutilsUpgrade policycoreutils-pythonUpgrade policycoreutils-newroleUpgrade policycoreutils-lang | Apr 19, 2018 | Mar 2, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 2, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub