CVE-2016-7545
published 2017-01-19CVE-2016-7545: SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
PriorityP343high8.8CVSS 3.0
AVLACLPRLUINSCCHIHAH
EPSS
0.38%
30.4th percentile
SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | policycoreutils | < policycoreutils 2.5-3 (bookworm) | policycoreutils 2.5-3 (bookworm) |
| fedoraproject | fedora | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
policycoreutils: SELinux sandbox escape via TIOCSTI ioctl
vendor_redhat·2016-09-22·CVSS 8.8
CVE-2016-7545 [HIGH] policycoreutils: SELinux sandbox escape via TIOCSTI ioctl
policycoreutils: SELinux sandbox escape via TIOCSTI ioctl
SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox.
Package: policycoreutils (Red Hat Enterprise Linux 5) - Not affected
Debian
CVE-2016-7545: policycoreutils - SELinux policycoreutils allows local users to execute arbitrary commands outside...
vendor_debian·2016·CVSS 8.8
CVE-2016-7545 [HIGH] CVE-2016-7545: policycoreutils - SELinux policycoreutils allows local users to execute arbitrary commands outside...
SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
Scope: local
bookworm: resolved (fixed in 2.5-3)
bullseye: resolved (fixed in 2.5-3)
forky: resolved (fixed in 2.5-3)
sid: resolved (fixed in 2.5-3)
trixie: resolved (fixed in 2.5-3)
VulDB
policycoreutils Sandbox access control (RHSA-2016:2702-01 / Nessus ID 94909)
vuldb·2026-05-14·CVSS 8.8
CVE-2016-7545 [HIGH] policycoreutils Sandbox access control (RHSA-2016:2702-01 / Nessus ID 94909)
A vulnerability marked as critical has been reported in policycoreutils. Affected is an unknown function of the component Sandbox. Performing a manipulation results in improper access controls.
This vulnerability is identified as CVE-2016-7545. The attack is only possible with local access. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
GHSA-38gv-g72v-rp63: SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call
ghsa_unreviewed·2022-05-14
CVE-2016-7545 [HIGH] CWE-284 GHSA-38gv-g72v-rp63: SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call
SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
OSV
CVE-2016-7545: SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call
osv·2017-01-19·CVSS 8.8
CVE-2016-7545 [HIGH] CVE-2016-7545: SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call
SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-7545 policycoreutils: SELinux sandbox escape via TIOCSTI ioctl [fedora-all]
bugzilla·2016-09-23·CVSS 8.8
CVE-2016-7545 [HIGH] CVE-2016-7545 policycoreutils: SELinux sandbox escape via TIOCSTI ioctl [fedora-all]
CVE-2016-7545 policycoreutils: SELinux sandbox escape via TIOCSTI ioctl [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versi
Bugzilla
CVE-2016-7545 policycoreutils: SELinux sandbox escape via TIOCSTI ioctl
bugzilla·2016-09-22·CVSS 7.8
CVE-2016-7545 [HIGH] CVE-2016-7545 policycoreutils: SELinux sandbox escape via TIOCSTI ioctl
CVE-2016-7545 policycoreutils: SELinux sandbox escape via TIOCSTI ioctl
Hi,
When executing a program via the SELinux sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
$ cat test.c
#include
#include
int main()
{
char *cmd = "id\n";
while(*cmd)
ioctl(0, TIOCSTI, cmd++);
execlp("/bin/id", "id", NULL);
}
$ gcc test.c -o test
$ /bin/sandbox ./test
id
uid=1000 gid=1000 groups=1000 context=unconfined_u:unconfined_r:sandbox_t:s0:c47,c176
[saken@ghetto ~]$ id Upstream fixes:
>
> * https://marc.info/?l=selinux&m=147465156612756&w=2
To be clear, the patch above is not strictly necessary, but very helpful.
commit 5b98f39de5119dcc865f6c7923682fb10219d45a
Author:
Bugzilla
CVE-2016-3105 mercurial: arbitrary code execution when converting git repos
bugzilla·2016-05-04·CVSS 9.8
CVE-2016-3105 [CRITICAL] CVE-2016-3105 mercurial: arbitrary code execution when converting git repos
CVE-2016-3105 mercurial: arbitrary code execution when converting git repos
A possible arbitrary code execution when converting Git repos was found in Mercirual. Mercurial prior to 3.8 allowed arbitrary code execution when using the convert extension on Git repos with hostile names. This could affect automated code conversion services that allow arbitrary repository names. This is a further side-effect of Git CVE-2015-7545.
External Reference:
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29
Upstream fix:
https://selenic.com/hg/rev/a56296f55a5e
Discussion:
Created mercurial tracking bugs for this issue:
Affects: fedora-all [bug 1332946]
Bugzilla
CVE-2016-3068 mercurial: command injection via git subrepository urls
bugzilla·2016-03-21·CVSS 9.8
CVE-2016-3068 [CRITICAL] CVE-2016-3068 mercurial: command injection via git subrepository urls
CVE-2016-3068 mercurial: command injection via git subrepository urls
It was reported that in mercurial, there is similar vulnerability as CVE-2015-7545 in git. Git's git-remote-ext remote helper provides an ext:: URL scheme that allows running arbitrary shell commands. Mercurial allows specifying git repositories as subrepositories. Git ext:: URLs can be specified as Mercurial subrepositories allowing arbitrary shell commands to be run on `hg clone ...`.
Discussion:
Acknowledgments:
Name: Blake Burkhart
---
*** Bug 1322266 has been marked as a duplicate of this bug. ***
---
External references:
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.7.3_.282016-3-29.29
Upstream fix:
https://selenic.com/repo/hg-stable/rev/34d43cb85de8
---
Created mercurial tracking bugs for th
http://rhn.redhat.com/errata/RHSA-2016-2702.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0535.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0536.htmlhttp://www.openwall.com/lists/oss-security/2016/09/25/1http://www.securityfocus.com/bid/93156http://www.securitytracker.com/id/1037283https://github.com/SELinuxProject/selinux/commit/acca96a135a4d2a028ba9b636886af99c0915379https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPRNK3PWMAVNJZ53YW5GOEOGJSFNAQIF/https://marc.info/?l=selinux&m=147465160112766&w=2http://rhn.redhat.com/errata/RHSA-2016-2702.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0535.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0536.htmlhttp://www.openwall.com/lists/oss-security/2016/09/25/1http://www.securityfocus.com/bid/93156http://www.securitytracker.com/id/1037283https://github.com/SELinuxProject/selinux/commit/acca96a135a4d2a028ba9b636886af99c0915379https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPRNK3PWMAVNJZ53YW5GOEOGJSFNAQIF/https://marc.info/?l=selinux&m=147465160112766&w=2
2017-01-19
Published