CVE-2021-47218

What it actually does

NULL pointer dereference in SELinux hashtab when hashtab_init() fails to allocate the slot array: size remains non-zero while htable is NULL, violating the assumption in policydb that hashtab_map() and hashtab_destroy() are safe to call on a failed hashtab.

Why it matters to the business

Kernel crashes or denial of service on Linux systems using SELinux when memory allocation fails during policy database initialization, potentially disrupting security enforcement and system availability.

How an attack unfolds

An attacker induces a hashtab allocation failure (for example under memory pressure during policy load), then triggers hashtab_map or hashtab_destroy calls; the non-zero size check passes while the NULL htable pointer is dereferenced, causing a kernel oops.

How to fix it

Apply the upstream kernel patch that initializes a valid empty hashtab on allocation failure in hashtab_init(); upgrade to any mainline or distribution kernel containing the selinux hashtab fix.

How to confirm the fix worked

Confirm the fix is present by inspecting hashtab.c for the updated hashtab_init logic that clears size on failure, or verify the running kernel is newer than the commit that resolved the NULL dereference.

Typical attack path

1. Cause memory allocation to fail inside hashtab_init() for a SELinux policy hashtab
2. Invoke subsequent hashtab_map() or hashtab_destroy() operations on the partially initialized structure
3. Trigger NULL pointer dereference leading to kernel panic or oops

How to detect it

Search kernel logs and crash dumps for NULL pointer dereference traces involving hashtab_map, hashtab_destroy, policydb, or selinux hashtab functions around policy load events.

What your security team should do

• Prioritize kernel updates on all SELinux-enabled systems
• Monitor kernel logs for SELinux hashtab or policydb NULL dereference oops
• Test policy loading under simulated memory pressure to validate stability