CVE-2021-36087

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Affected products

Almalinux, Centos, Linuxmint, Red Hat, Rocky Linux, Selinux, Ubuntu

Selinux Project Selinux

= 3.2

CVSS 3.1

3.3 LOW

EPSS

0.5% (37th percentile)

Weakness

CWE-125

NVD status

Modified

Published

2021-07-01

No exploit for CVE-2021-36087 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.