CVE-2021-36087 : The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Published 2021-07-01 03:15:09

Updated 2021-11-17 14:05:02

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2021-36087

Fedoraproject » Fedora » Version: 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Matching versions
Selinux Project » Selinux » Version: 3.2
cpe:2.3:o:selinux_project:selinux:3.2:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-36087

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 29 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-36087

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:N/A:P	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
3.3	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	1.8	1.4	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2021-36087

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-36087

https://lore.kernel.org/selinux/CAEN2sdqJKHvDzPnxS-J8grU8fSf32DDtx=kyh84OsCq_Vm+yaQ@mail.gmail.com/T/

libsepol CVE patch issue
Mailing List;Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32675

32675 - selinux:secilc-fuzzer: Heap-buffer-overflow in ebitmap_match_any - oss-fuzz
Exploit;Issue Tracking;Patch;Third Party Advisory
https://github.com/SELinuxProject/selinux/commit/340f0eb7f3673e8aacaf0a96cbfcd4d12a405521

libsepol/cil: Check for statements not allowed in optional blocks · SELinuxProject/selinux@340f0eb · GitHub
Patch;Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-585.yaml

oss-fuzz-vulns/OSV-2021-585.yaml at main · google/oss-fuzz-vulns · GitHub
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U7ZYR3PIJ75N6U2IONJWCKZ5L2NKJTGR/

[SECURITY] Fedora 35 Update: libsepol-3.3-2.fc35 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-36087

Products affected by CVE-2021-36087

Exploit prediction scoring system (EPSS) score for CVE-2021-36087

CVSS scores for CVE-2021-36087

CWE ids for CVE-2021-36087

References for CVE-2021-36087