CVE-2021-36084
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __cil_verify_classpermission and __cil_pre_verify_helper.
Risk Assessment
This vulnerability could cause system crashes or potential arbitrary code execution by an attacker, threatening system integrity and availability.
Recommendation
It is recommended to update SELinux to version 3.3 or later, which includes a fix for this vulnerability.
Other vulnerabilities in SELinux
See all- CVE-2021-36087Low
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any, called indirectly from cil_check_neverallow. This occurs due to missing validation of invalid statements in an optional block.
- CVE-2021-36086Low
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the cil_reset_classpermission function, called from cil_reset_classperms_set and cil_reset_classperms_list. This could lead to unexpected behavior or potential exploitation by an attacker.
- CVE-2021-36085Low
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __verify_map_perm_classperms and hashtab_map. This could lead to unexpected behavior or potential exploitation by an attacker.
Original NVD description (English source)
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS