CVE-2025-68733

Vulnerability

In the Linux kernel's Smack security module, a bug in the do_setattr() function allows an unprivileged task to create new Smack labels if it is permitted to relabel itself (i.e., /smack/relabel-self is not empty). The flaw occurs because the function imports the provided label into the kernel's label database *before* checking whether the task is allowed to use that label via the relabel-self list [1].

Exploitation

An attacker who can write to their own /proc/PID/attr/smack/current file (which is possible when the relabel-self mechanism is enabled) can supply an arbitrary label name. The kernel will create that label in the Smack label database without verifying that the task is authorized to introduce new labels. No additional privileges are required beyond the ability to write to the procfs attribute file [1].

Impact

By creating arbitrary labels, an unprivileged attacker can bypass Smack's mandatory access control policies. This could allow the attacker to assign themselves or other objects labels that grant unintended access to resources, potentially leading to privilege escalation or privilege escalation [1].

Mitigation

The fix, already applied in the Linux kernel stable tree, moves the relabel-self permission check to occur *before* the label is imported. Users should update to a kernel version containing the commit 4a7a7621619a or later [1]. No workaround is available other than disabling the relabel-self feature if it is not needed.