Description

A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-07T08:16:46.160Z",
  "pubdate": "2026-08-07T08:16:46.160Z",
  "executiveSummary": "A Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability exists within the fixfiles script in policycoreutils. This flaw allows a local attacker to manipulate file paths during relabeling or restore operations, creating a race window between file discovery and the security context modification. By exploiting this gap, an adversary can substitute directory components with symbolic links, forcing the chcon command to follow the symlinks and alter SELinux security contexts on arbitrary system files. The primary impact of this vulnerability is the potential subversion of SELinux mandatory access control protections on critical system files such as /etc/shadow, thereby compromising the integrity of the security policy enforcement mechanism. Exploitation requires local access to the system and the ability to execute the fixfiles script with elevated privileges, targeting temporary or arbitrary directories where unlabeled files are being processed. The risk implication is significant as it weakens the host's access control architecture, potentially facilitating further privilege escalation or unauthorized system modification by local malicious actors.",
  "technicalDetails": "The vulnerability resides in the fixfiles script utilized within policycoreutils, specifically during the execution of fixfiles relabel or fixfiles restore operations. The root cause stems from insecure file system handling where the script performs a non-atomic two-step operation: first locating unlabeled files under /tmp and other directories using the find utility, and subsequently applying security context modifications via the chcon command.\nThe vulnerable component is the fixfiles script logic that processes file paths discovered by find without ensuring that the underlying directory structure remains immutable or verified between the time of check and the time of use. Because the script operates across a time window between discovery and the execution of chcon, a local attacker with standard user privileges can monitor these operations and execute a race condition attack.\nThe exploitation method involves the attacker identifying the race window and dynamically swapping directory components along the targeted file path with symbolic links pointing to sensitive system files. When the fixfiles script subsequently invokes chcon on the previously identified path, chcon follows the newly planted symbolic link rather than the original directory structure.\nThe step-by-step attack flow proceeds as follows: First, the administrator or a scheduled task initiates fixfiles relabel or fixfiles restore. Second, the find utility scans directories such as /tmp to identify files requiring SELinux context relabeling. Third, before the script executes chcon on the discovered paths, the local attacker rapidly replaces a component of the directory path with a symlink pointing to a critical asset like /etc/shadow. Fourth, the script executes chcon, which resolves the path by following the attacker-controlled symlink. Finally, chcon modifies the SELinux security context of the unintended arbitrary file.\nThe requirements for exploitation include local access to the system, low-level user privileges sufficient to manipulate files or directories within the scan scope (such as /tmp), and the timing synchronization required to intercept the interval between the find discovery phase and the chcon execution phase. Network exposure is not required as the vulnerability is strictly local. Post-exploitation impact includes the degradation of SELinux mandatory access controls, potentially permitting unauthorized read or write access depending on how the modified security context alters the targeted file's accessibility under the active policy."
}