Skip to content
OpenAdvisories
Medium ALAS2-2023-2307 4 CVEs

Moderate: libsepol security update (Amazon Linux 2)

Published Oct 12, 2023 · Updated Oct 19, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-36087: The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block. CVE-2021-36086: The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). CVE-2021-36085: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map). CVE-2021-36084: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 libsepol 0:2.5-10.amzn2.0.1
Amazon Linux · 2 libsepol-debuginfo 0:2.5-10.amzn2.0.1
Amazon Linux · 2 libsepol-devel 0:2.5-10.amzn2.0.1
Amazon Linux · 2 libsepol-static 0:2.5-10.amzn2.0.1

Vulnerabilities 4

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-36084.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-36085.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-36086.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-36087.html