Description
The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | setroubleshoot +1 | 3.2.24-1.1.el7 | RHBA-2015:2287 |
| RHEL 6 | setroubleshoot +2 | 3.0.47-12.el6_8 | RHSA-2016:1267 |
| RHEL 6 | setroubleshoot-plugins | 3.0.40-3.1.el6_8 | RHSA-2016:1267 |
Advisories 2
- RHSA-2016:1267 Red Hat Security Advisory: setroubleshoot and setroubleshoot-plugins security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHBA-2015:2287 Red Hat Bug Fix Advisory: setroubleshoot bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026