CVE-2021-36087
LowSummary
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any, called indirectly from cil_check_neverallow. This occurs due to missing validation of invalid statements in an optional block.
Risk Assessment
This vulnerability could allow an attacker to execute arbitrary code or cause a system crash by sending specially crafted SELinux policies, threatening system integrity and availability.
Recommendation
Immediately update SELinux to version 3.3 or later, which includes a fix for the buffer over-read. In the meantime, restrict access to SELinux policy compilation tools to trusted users only.
Original NVD description (English source)
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.