CVE-2018-1063

Name of the Vulnerable Software and Affected Versions policycoreutils version 2.5-11

Description The issue allows a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions through a symbolic link attack on filesystems during the context relabeling process. This typically occurs when transitioning the SELinux state from disabled to enabled, either in permissive or enforcing mode.

Recommendations For policycoreutils version 2.5-11, consider restricting the use of the context relabeling feature until a patch is available, and ensure that SELinux state transitions are carefully managed to minimize the risk of exploitation.