CVE-2021-36084
published 2021-07-01CVE-2021-36084: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).
PriorityP410low3.3CVSS 3.1
AVLACLPRNUIRSUCNINAL
EPSS
0.48%
38.3th percentile
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsepol | < libsepol 3.3-1 (bookworm) | libsepol 3.3-1 (bookworm) |
| fedoraproject | fedora | — | — |
| selinux_project | selinux | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
osv3.3LOW
vendor_debian3.3LOW
vendor_redhat3.3LOW
vendor_ubuntu3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libsepol vulnerabilities
vendor_ubuntu·2022-04-27·CVSS 3.3
CVE-2021-36086 [LOW] libsepol vulnerabilities
Title: libsepol vulnerabilities
Summary: Several security issues were fixed in libsepol.
Nicolas Iooss discovered that libsepol incorrectly handled memory
when handling policies. An attacker could possibly use this issue
to cause a crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2021-36084)
It was discovered that libsepol incorrectly handled memory when
handling policies. An attacker could possibly use this issue to cause
a crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2021-36085)
It was discovered that libsepol incorrectly handled memory when
handling policies. An attacker could possibly use this issue to cause
a crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affects Ubu
Red Hat
libsepol: use-after-free in __cil_verify_classperms()
vendor_redhat·2021-04-19·CVSS 3.3
CVE-2021-36084 [LOW] CWE-416 libsepol: use-after-free in __cil_verify_classperms()
libsepol: use-after-free in __cil_verify_classperms()
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).
Package: libsepol (Red Hat Enterprise Linux 6) - Not affected
Package: libsepol (Red Hat Enterprise Linux 7) - Fix deferred
Package: libsepol (Red Hat Enterprise Linux 9) - Not affected
Debian
CVE-2021-36084: libsepol - The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms ...
vendor_debian·2021·CVSS 3.3
CVE-2021-36084 [LOW] CVE-2021-36084: libsepol - The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms ...
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).
Scope: local
bookworm: resolved (fixed in 3.3-1)
bullseye: resolved (fixed in 3.1-1+deb11u1)
forky: resolved (fixed in 3.3-1)
sid: resolved (fixed in 3.3-1)
trixie: resolved (fixed in 3.3-1)
GHSA
GHSA-8p9r-xrm6-68wq: The CIL compiler in SELinux 3
ghsa_unreviewed·2022-05-24
CVE-2021-36084 [MEDIUM] CWE-416 GHSA-8p9r-xrm6-68wq: The CIL compiler in SELinux 3
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).
OSV
libsepol vulnerabilities
osv·2022-04-27·CVSS 3.3
CVE-2021-36084 [LOW] libsepol vulnerabilities
libsepol vulnerabilities
Nicolas Iooss discovered that libsepol incorrectly handled memory
when handling policies. An attacker could possibly use this issue
to cause a crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2021-36084)
It was discovered that libsepol incorrectly handled memory when
handling policies. An attacker could possibly use this issue to cause
a crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2021-36085)
It was discovered that libsepol incorrectly handled memory when
handling policies. An attacker could possibly use this issue to cause
a crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affects Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2021-36086
OSV
CVE-2021-36084: The CIL compiler in SELinux 3
osv·2021-07-01·CVSS 3.3
CVE-2021-36084 [LOW] CVE-2021-36084: The CIL compiler in SELinux 3
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31065https://github.com/SELinuxProject/selinux/commit/f34d3d30c8325e4847a6b696fe7a3936a8a361f3https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-417.yamlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U7ZYR3PIJ75N6U2IONJWCKZ5L2NKJTGR/https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31065https://github.com/SELinuxProject/selinux/commit/f34d3d30c8325e4847a6b696fe7a3936a8a361f3https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-417.yamlhttps://lists.debian.org/debian-lts-announce/2024/10/msg00021.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U7ZYR3PIJ75N6U2IONJWCKZ5L2NKJTGR/https://security.netapp.com/advisory/ntap-20250207-0004/
2021-07-01
Published