Link following in SELinux Project policycoreutils
Priority LOW 21CWE-59Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 10 fixed, 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.
Summary
Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.
Why it matters now
EPSS 0.00402 34th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 10 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SELinux Project | policycoreutils | 2.5-11 and newer | — | No fix listed | CNA |
- policycoreutils VendorSELinux Project Affected 2.5-11 and newer Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:selinux_project:selinux:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | SELinux Project |
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:selinux_project:selinux:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·SELinux Project
Remediation
Red Hat 1 advisory
- RHSA-2018:0913 Released 2018-04-10 · Red Hat rating Lowpolicycoreutils security, bug fix, and enhancement update
- Red Hat Enterprise Linux Client (v. 7) policycoreutils-2.5-22.el7, policycoreutils-devel-2.5-22.el7, policycoreutils-gui-2.5-22.el7 +3
- Red Hat Enterprise Linux Client Optional (v. 7) policycoreutils-restorecond-2.5-22.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) policycoreutils-2.5-22.el7, policycoreutils-newrole-2.5-22.el7, policycoreutils-python-2.5-22.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) policycoreutils-devel-2.5-22.el7, policycoreutils-gui-2.5-22.el7, policycoreutils-restorecond-2.5-22.el7 +1
- Red Hat Enterprise Linux Server (v. 7) policycoreutils-2.5-22.el7, policycoreutils-devel-2.5-22.el7, policycoreutils-devel-2.5-22.el7.ppc +4
- Red Hat Enterprise Linux Server Optional (v. 7) policycoreutils-restorecond-2.5-22.el7
- Red Hat Enterprise Linux Workstation (v. 7) policycoreutils-2.5-22.el7, policycoreutils-devel-2.5-22.el7, policycoreutils-gui-2.5-22.el7 +3
- Red Hat Enterprise Linux Workstation Optional (v. 7) policycoreutils-restorecond-2.5-22.el7
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) policycoreutils-2.5-22.el7, policycoreutils-devel-2.5-22.el7, policycoreutils-gui-2.5-22.el7 +3
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) policycoreutils-restorecond-2.5-22.el7
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2018:0913 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2018:0913 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2018:0913 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2018:0913 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2018:0913 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2018:0913 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2018:0913 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2018:0913 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) | Fixed | RHSA-2018:0913 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) | Fixed | RHSA-2018:0913 |
Not affected: 2 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1063
- 2026-10-03 Alias added: GHSA-p5j6-rvwf-qchg
References
More SELinux Project Selinux vulnerabilities
- TI-2016-06417 SELinux policycoreutils allows local users to execute arbitrary commands outside of the… CVSS 3.0HIGH 8.8
- TI-2015-02801 selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to… CVSS 3.0MEDIUM 5.5
- TI-2021-14537 The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any… CVSS 3.1LOW 3.3
- TI-2021-14536 The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called… CVSS 3.1LOW 3.3
- TI-2021-14535 The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called… CVSS 3.1LOW 3.3
- TI-2021-14534 The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called… CVSS 3.1LOW 3.3
Sources
- CVE-2018-1063 · CVE Program
- CVE-2018-1063 · NVD
- FIRST EPSS
- GHSA-p5j6-rvwf-qchg · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1063 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences