Описание
In the Linux kernel, the following vulnerability has been resolved:
selinux: always fill AVC decision in avc_has_perm_noaudit()
avc_has_perm_noaudit() is documented to return a copy of the access
decision in @avd, but its early return for an empty requested permission
set leaves the buffer untouched. All callers pass an uninitialized
stack variable and afterwards feed it to avc_audit(), and the inode hook
even stores it in the per-task decision cache.
Fill in a deny-all, audit-all decision, similar to avd_init(), so every
caller receives a defined value at no cost on the hot path.
A flaw was found in the Linux kernel's SELinux (Security-Enhanced Linux) subsystem. When an access check is performed with an empty permission set, the Access Vector Cache (AVC) fails to initialize the access decision structure before returning. A local attacker can exploit this flaw by triggering operations that cause the kernel to read uninitialized stack memory during audit logging and decision caching, potentially leading to a denial of service or unpredictable security enforcement.
Отчет
A flaw of moderate impact was found in the Linux kernel's SELinux Access Vector Cache (AVC) subsystem as shipped in the Red Hat kernel. When avc_has_perm_noaudit() is called with an empty requested permission set, it returns early without filling in the access decision structure, leaving the caller-provided stack variable uninitialized. That uninitialized value is subsequently passed to avc_audit() for audit logging and, in the inode hook, stored in the per-task AVC decision cache, so the kernel may act on uninitialized stack memory. A local attacker with low privileges could trigger operations that perform SELinux access checks with an empty permission set, causing the kernel to use this uninitialized data during audit logging and decision caching, which can result in unpredictable SELinux enforcement or a denial of service (availability impact only; CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Within the current product scope, the Red Hat kernel in RHEL 8, RHEL 9, and RHEL 10 update streams, RHEL In-Vehicle OS (RHIVOS) 2, and the kernel shipped with OpenShift 4 and OpenShift 5 is affected. Fixes for these affected streams are currently deferred, so they will be addressed in a future planned update rather than an immediate erratum; the residual risk until then is limited to local availability impact by an already-authenticated local user, with no direct confidentiality or integrity impact. RHEL 7 is not affected because the vulnerable code is not present in that kernel, and the RHEL 6 stream is marked out of support scope.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache. Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.
In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache. Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.
In the Linux kernel, the following vulnerability has been resolved: s ...
In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache. Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.
EPSS
5.5 Medium
CVSS3