Moderate: libsepol security update
Summary
ALSA-2021:4513: Moderate: libsepol security update. Affects libsepol versions < 2.9-3.el8. Fixed in 2.9-3.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libsepol library is responsible for providing an API for the manipulation of SELinux binary policies. It is utilized by various tools such as checkpolicy (the policy compiler) and programs like load_policy that require specific transformations on binary policies. The library allows customization of policy boolean settings and performs essential functions related to SELinux policies.
Vulnerability Detail
The libsepol library is affected by multiple vulnerabilities:
- CVE-2021-36084: A use-after-free vulnerability in __cil_verify_classperms() function.
- CVE-2021-36085: Another use-after-free vulnerability in __cil_verify_classperms() function.
- CVE-2021-36086: A use-after-free vulnerability in cil_reset_classpermission() function.
- CVE-2021-36087: A heap-based buffer overflow vulnerability in ebitmap_match_any() function.
These vulnerabilities can potentially lead to security breaches, allowing attackers to execute arbitrary code or cause denial of service (DoS) conditions. The impact of these vulnerabilities can vary depending on the context in which the libsepol library is used.
How To Fix
Minimum fixed version
2.9-3.el8
This is the first release that contains the fix.
sudo dnf update libsepolTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds available for these vulnerabilities. It is recommended to apply the provided fix by updating the libsepol package to the latest version.
Conclusion
In conclusion, the libsepol library is affected by multiple vulnerabilities that can potentially lead to security breaches. It is crucial to update the libsepol package to the latest version to mitigate these vulnerabilities. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for libsepol →
FAQ
libsepol is a library that provides an API for the manipulation of SELinux binary policies. It is used by various tools and programs to handle SELinux policies.
These vulnerabilities can potentially allow attackers to execute arbitrary code or cause denial of service (DoS) conditions. The impact may vary depending on the context in which the libsepol library is used.
You can use vulnerability monitoring tools like Vulert to check if your system is affected by these vulnerabilities. Vulert analyzes package manifests and provides real-time alerts for open-source vulnerabilities.
No, there are no known workarounds available for these vulnerabilities. It is recommended to update the libsepol package to the latest version.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and acknowledgments, on the respective CVE pages: CVE-2021-36084, CVE-2021-36085, CVE-2021-36086, CVE-2021-36087.
Related vulnerabilities
Recent vulnerabilities recorded for libsepol.
