CVE-2021-36087
LowSummary
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any, called indirectly from cil_check_neverallow. This occurs due to missing validation of invalid statements in an optional block.
Risk Assessment
This vulnerability could allow an attacker to execute arbitrary code or cause a system crash by sending specially crafted SELinux policies, threatening system integrity and availability.
Recommendation
Immediately update SELinux to version 3.3 or later, which includes a fix for the buffer over-read. In the meantime, restrict access to SELinux policy compilation tools to trusted users only.
Other vulnerabilities in SELinux
See all- CVE-2021-36084Low
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __cil_verify_classpermission and __cil_pre_verify_helper.
- CVE-2021-36086Low
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the cil_reset_classpermission function, called from cil_reset_classperms_set and cil_reset_classperms_list. This could lead to unexpected behavior or potential exploitation by an attacker.
- CVE-2021-36085Low
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __verify_map_perm_classperms and hashtab_map. This could lead to unexpected behavior or potential exploitation by an attacker.
Original NVD description (English source)
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS