CVE-2011-1011

Name of the Vulnerable Software and Affected Versions policycoreutils versions 2.0.83 and earlier policycoreutils-sandbox version 2.0.83 policycoreutils-python version 2.0.83 policycoreutils-debuginfo version 2.0.83 policycoreutils-newrole version 2.0.83 policycoreutils-gui version 2.0.83 selinux-policy version 3.7.19 selinux-policy-minimum version 3.7.19 selinux-policy-mls version 3.7.19 selinux-policy-doc version 3.7.19 selinux-policy-targeted version 3.7.19

Description The vulnerability can be exploited locally, potentially leading to a disruption of confidentiality, integrity, and availability of protected information. The seunshare mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory. This allows local users to replace or delete arbitrary /tmp files and consequently cause a denial of service or possibly gain privileges by running a setuid application that relies on /tmp.

Recommendations For policycoreutils versions 2.0.83 and earlier, consider disabling the seunshare mount function until a patch is available. For policycoreutils-sandbox version 2.0.83, restrict access to the vulnerable seunshare module to minimize the risk of exploitation. For policycoreutils-python version 2.0.83, avoid using the policycoreutils package in sensitive operations until the issue is resolved. For policycoreutils-debuginfo version 2.0.83, policycoreutils-newrole version 2.0.83, policycoreutils-gui version 2.0.83, selinux-policy version 3.7.19, selinux-policy-minimum version 3.7.19, selinux-policy-mls version 3.7.19, selinux-policy-doc version 3.7.19, and selinux-policy-targeted version 3.7.19, there is no information about a newer version that contains a fix for this vulnerability.