CVE-2021-36086
LowSummary
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the cil_reset_classpermission function, called from cil_reset_classperms_set and cil_reset_classperms_list. This could lead to unexpected behavior or potential exploitation by an attacker.
Risk Assessment
The risk involves potential remote code execution or privilege escalation in systems using SELinux, which could compromise the integrity and confidentiality of organizational data.
Recommendation
It is recommended to immediately update SELinux to version 3.3 or later, which includes a fix for this vulnerability.
Other vulnerabilities in SELinux
See all- CVE-2021-36084Low
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __cil_verify_classpermission and __cil_pre_verify_helper.
- CVE-2021-36087Low
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any, called indirectly from cil_check_neverallow. This occurs due to missing validation of invalid statements in an optional block.
- CVE-2021-36085Low
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __verify_map_perm_classperms and hashtab_map. This could lead to unexpected behavior or potential exploitation by an attacker.
Original NVD description (English source)
The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS