CWE Code: 59
Vulnerability Type: privilege_escalation
CVSS Score: 3.3
CWE Name:  Improper Link Resolution Before File Access ('Link Following')
Summary: context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the selinux context of an arbitrary file to a context with few restrictions. this only happens when the relabeling process is done, usually when taking selinux state from disabled to enable (permissive or enforcing). the issue was found in policycoreutils 2.5-11.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/PARTIAL/NONE
Published Date: 2018-03-02
Last Modified Date: 2018-04-12