What is CVE-2018-1063?

CVE-2018-1063 is a medium-severity vulnerability in Selinux Project Policycoreutils, classified under Improper Link Resolution Before File Access. CVSS score: 4.4/10. Published 2018-03-02.

How severe is CVE-2018-1063?

Medium severity. CVSS v3 base score is 4.4 out of 10.

Vulnerability in Selinux Project Policycoreutils

CVE-2018-1063

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Published 2018-03-02 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.004 (30.3th percentile), scored 2026-10-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 30.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Selinux Project Policycoreutils — versions 2.5-11 and newer
Selinux Project
Red Hat Enterprise Linux — versions 7.0

Weakness classification (CWE)

CWE-59 — Improper Link Resolution Before File Access

References

bugzilla.redhat.com/show_bug.cgi (Mitigation, Issue Tracking, Vendor Advisory)
access.redhat.com/errata/RHSA-2018:0913 (vendor-advisory)

Frequently asked questions

What is CVE-2018-1063?: CVE-2018-1063 is a medium-severity vulnerability in Selinux Project Policycoreutils, classified under Improper Link Resolution Before File Access. CVSS score: 4.4/10. Published 2018-03-02.
How severe is CVE-2018-1063?: Medium severity. CVSS v3 base score is 4.4 out of 10.