SELinux Permission Value Validation Bypass

Executive Summary

This is a Linux kernel vulnerability where the SELinux permission handling allows a permission value to exceed the class permission count. The function perm_read() does not properly validate the permission value against the class's nprim (number of permissions), leading to an out-of-bounds heap write when security_get_permissions() writes to an array sized by nprim.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to SELinux policy handling in the Linux kernel. Detection requires checking SELinux policy files for permission values exceeding class permission counts. Use commands like 'semodule -l' to list loaded modules and inspect policy files for inconsistencies. Kernel logs may also show related errors during policy loading.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It may also enable bypassing security controls enforced by SELinux.

Useful 0 Not Useful 0

Mitigation Strategies

Update to a patched Linux kernel version that includes the fix for this SELinux vulnerability. Avoid loading custom SELinux policies until they are verified to comply with the corrected bounds checking. Monitor kernel logs for permission-related errors after updates.

Useful 0 Not Useful 0