CVE-2021-36084

What it actually does

Use-after-free vulnerability in the CIL compiler's __cil_verify_classperms function (invoked via __cil_verify_classpermission and __cil_pre_verify_helper) allows a local attacker to trigger memory corruption or a crash when processing a malicious policy file.

Why it matters to the business

Local users or automated policy compilation processes could experience denial-of-service crashes or instability when handling untrusted SELinux policy sources, potentially disrupting system hardening or policy deployment workflows.

How an attack unfolds

An attacker crafts a malicious CIL policy file that triggers the use-after-free during verification of class permissions; when the file is compiled by the vulnerable CIL compiler (for example via semodule or checkpolicy), the freed memory is accessed, leading to a crash or limited memory corruption.

How to fix it

Upgrade selinuxproject/selinux to the commit f34d3d30c8325e4847a6b696fe7a3936a8a361f3 or later; rebuild and reinstall affected tools such as the CIL compiler and policy utilities; avoid compiling untrusted CIL policy files until patched.

How to confirm the fix worked

Confirm the installed SELinux tools were built from a source tree containing commit f34d3d30c8325e4847a6b696fe7a3936a8a361f3; test compilation of known-triggering CIL samples to verify absence of crashes; review build logs and package versions for the fix.

Typical attack path

1. Identify or obtain access to a system using vulnerable SELinux CIL compiler
2. Create a specially crafted CIL source file that exercises the verification path
3. Invoke the compiler (directly or via policy management tools) on the malicious file
4. Trigger the use-after-free resulting in crash or memory corruption

How to detect it

Review system and application logs for unexpected crashes or segmentation faults in CIL-related binaries (cil, checkpolicy, semodule) during policy compilation; look for repeated invocations of policy tools on files from untrusted sources.

What your security team should do

• Apply the upstream commit f34d3d30c8325e4847a6b696fe7a3936a8a361f3 immediately on all systems that compile CIL policies
• Restrict local compilation of untrusted SELinux policies until patched
• Monitor for policy compilation failures or crashes in logs