policycoreutils: local privilege escalation via seunshare

A flaw was found in the way seunshare, a utility for running executables under a different security context, used the capnglock functionality of the libcap-ng library. The subsequent invocation of suid root binaries that relied on the fact that the setuid system call, among others, also sets the...

Medium: kernel

Issue Overview: A flaw was found in the way seunshare, a utility for running executables under a different security context, used the capnglock functionality of the libcap-ng library. The subsequent invocation of suid root binaries that relied on the fact that the setuid system call, among others...

[oss-security] Re: local privilege escalation due to capng_lock as used in seunshare

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We think there should be a CVE ID for the combination of these two observations: 1. seunshare is intended to be setuid root see the http://userspace.selinuxproject.org/trac/browser/policycoreutils/sandbox/Makefile file 2. dropping privileges no longer...