Description
seunshare in policycoreutils 2.2.5 is owned by root with 4755 permissions, and executes programs in a way that changes the relationship between the setuid system call and the getresuid saved set-user-ID value, which makes it easier for local users to gain privileges by leveraging a program that mistakenly expected that it could permanently drop privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | libcap-ng +3 | 0.7.5-4.el7 | RHBA-2015:2161 |
| RHEL 6 | perf +16 | 2.6.32-504.16.2.el6 | RHSA-2015:0864 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | libcap-ng | 0.6.3-1.9.6 | SUSE-SU-2017:0375-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 11 SP4 | libcap-ng | 0.6.3-1.9.6 | SUSE-SU-2017:0375-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | dtrace-modules-3.8.13-68.1.3.el6uek | 0.4.3-4.el6 | ELSA-2015-3032 |
| Oracle Linux 7 | dtrace-modules-3.8.13-68.1.3.el7uek | 0.4.3-4.el7 | ELSA-2015-3032 |
| Oracle Linux 7 | kernel-uek +5 | 3.8.13-68.1.3.el7uek | ELSA-2015-3032 |
Advisories 4
- RHSA-2015:0864 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2015:2161 Red Hat Bug Fix Advisory: libcap-ng bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- SUSE-SU-2017:0375-1 Security update for libcap-ng SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-3032 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 23, 2015
References
- 67341 vdb-entry
- openSUSE-SU-2014:0749 vendor-advisory
- [oss-security] 20140507 Re: local privilege escalation due to capng_lock as used in seunshare mailing-list
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://advisories.mageia.org/MGASA-2014-0251.html
- 59007 third-party-advisory
- RHSA-2015:0864 vendor-advisory
- MDVSA-2015:156 vendor-advisory
- [oss-security] 20140430 Re: local privilege escalation due to capng_lock as used in seunshare mailing-list
- [oss-security] 20140429 local privilege escalation due to capng_lock as used in seunshare mailing-list