Skip to content
OpenAdvisories
Medium ALAS2023-2023-017 4 CVEs

Moderate: libsepol security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-36087: The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block. CVE-2021-36086: The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). CVE-2021-36085: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map). CVE-2021-36084: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 libsepol 0:3.4-3.amzn2023.0.3
Amazon Linux · 2023 libsepol-debuginfo 0:3.4-3.amzn2023.0.3
Amazon Linux · 2023 libsepol-debugsource 0:3.4-3.amzn2023.0.3
Amazon Linux · 2023 libsepol-devel 0:3.4-3.amzn2023.0.3
Amazon Linux · 2023 libsepol-static 0:3.4-3.amzn2023.0.3
Amazon Linux · 2023 libsepol-utils 0:3.4-3.amzn2023.0.3
Amazon Linux · 2023 libsepol-utils-debuginfo 0:3.4-3.amzn2023.0.3

Vulnerabilities 4

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-36084.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-36085.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-36086.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-36087.html