Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

opencontainers/selinux

              main @ 1ee8c10
            

Fixes

CVEs

CRITICAL

Peak severity

0.0%

Coverage

Highlights

Privilege Escalation / Container Escape: 2 prior fixes. Scrutinize any change in this area.

go-selinux/label/label_selinux.go: most-fixed (3 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Privilege Escalation / Container Escape: Direct writes/reads to /proc/self/attr paths are vulnerable to bind-mount and symlink attacks, allowing escape from SELinux confinement.

Privilege Escalation / Container Escape: A missing procfs check on file handles enabled writing to non-procfs files, leading to CVE-2019-16884-style attacks.

Race Condition leading to SELinux isolation bypass: MCS labels could be freed and reallocated to another process due to a race, breaking isolation between containers.