Linux Kernel SELinux AVC Cache Auditing Vulnerability

A vulnerability in the Linux kernel's SELinux implementation was introduced by a change that moved the per-task AVC cache to the task's security structure. The vulnerability arises because the cache was incorrectly saving and reusing the audited vector from a previous permission check, rather than recalculating it based on the current permissions requested. This flaw meant that some permission checks, particularly directory write permissions following a cached directory search, were not properly audited. The issue has been fixed by ensuring that the auditing process accurately reflects the current permission requests and distinguishes between denied and allowed cases.

Impact

The vulnerability could lead to improper auditing of permission checks, allowing certain actions to be performed without the appropriate oversight. This could be exploited by manipulating the timing of file operations to evade audit trails, potentially hiding malicious activity from monitoring systems.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.