CVE-2015-0238

Vulnerability

A vulnerability in the selinux-policy package as shipped with Red Hat OpenShift 2 allows an attacker to obtain process listing information through a privilege escalation attack [1]. The issue resides in the SELinux policy configuration, which does not properly restrict access to process information, enabling a local user to escalate privileges and read the process list [2]. Affected versions include all selinux-policy packages distributed with Red Hat OpenShift 2.

Exploitation

An attacker must have local access to the system and the ability to execute code. By exploiting the insufficient SELinux policy restrictions, the attacker can escalate their privileges to a level that permits reading the process listing of other users or the system [1][2]. The exact sequence of steps is not publicly detailed, but the attack leverages the misconfigured policy to bypass intended access controls.

Impact

Successful exploitation results in information disclosure: the attacker gains the ability to view the process listing, revealing which processes are running on the system [1][2]. This could expose sensitive information about running services, user activities, or system configuration. The impact is limited to confidentiality, with no direct effect on integrity or availability.

Mitigation

Red Hat has rated this issue as Low severity and stated that a future update may address it [2]. As of the publication date, no official patch has been released. Users of Red Hat OpenShift 2 should monitor for updates and consider restricting local access to trusted users as a workaround. Red Hat OpenShift 2 is no longer supported, so upgrading to a supported version is recommended.