CVE-2021-36084: SELinux Use-After-Free Vulnerability

CVE-2021-36084 Overview

CVE-2021-36084 is a use-after-free vulnerability in the CIL (Common Intermediate Language) compiler component of SELinux 3.2. The flaw exists within the __cil_verify_classperms function, which is called from __cil_verify_classpermission and __cil_pre_verify_helper. This memory corruption vulnerability could allow an attacker with local access to cause a denial of service condition by providing specially crafted CIL policy files that trigger the use-after-free condition during policy compilation.

Critical Impact

Local attackers can exploit this use-after-free vulnerability in SELinux's CIL compiler to cause application crashes and potential denial of service when processing malicious CIL policy files.

Affected Products

• SELinux Project SELinux version 3.2
• Fedora Project Fedora 35
• Systems utilizing SELinux CIL compiler for policy compilation

Discovery Timeline

• 2021-07-01 - CVE-2021-36084 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2021-36084

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption issue where memory is accessed after it has been freed. In the context of SELinux's CIL compiler, the vulnerable code path involves the __cil_verify_classperms function which improperly handles memory associated with class permissions lists during policy verification. When processing certain CIL policy constructs, the compiler may attempt to access memory that has already been deallocated, leading to undefined behavior.

The vulnerability was discovered through automated fuzzing by OSS-Fuzz (Issue #31065), which identified the problematic memory access pattern in the CIL policy verification routines. The attack requires local access and user interaction (processing a malicious CIL file), limiting its immediate exploitability but still presenting a risk in environments where CIL policies are compiled from untrusted sources.

Root Cause

The root cause lies in improper memory management within the cil_reset_classpermission function in libsepol/cil/src/cil_reset_ast.c. When resetting a class permission structure, the original code called cil_reset_classperms_list() which would reset the list contents but leave the list structure intact. This created a situation where the classperms list could be used after its contents had been effectively invalidated, causing the use-after-free condition when the verification functions attempted to traverse the list.

Attack Vector

The attack vector is local, requiring an attacker to supply a maliciously crafted CIL policy file to the SELinux CIL compiler. The exploitation scenario involves:

1. Crafting a CIL policy file that triggers the vulnerable code path in __cil_verify_classperms
2. Having the target system process this file through the CIL compiler (secilc or integrated policy compilation)
3. The use-after-free condition is triggered during policy verification, causing memory corruption

The following patch demonstrates how the SELinux project addressed this vulnerability:

 	return;
 }

-	cil_reset_classperms_list(cp->classperms);
+	cil_list_destroy(&cp->classperms, CIL_FALSE);
}

static void cil_reset_classperms_set(struct cil_classperms_set *cp_set)

Source: GitHub SELinux Commit

The fix replaces the cil_reset_classperms_list() call with cil_list_destroy(), which properly destroys the classperms list and its associated memory, preventing the use-after-free condition from occurring.

Detection Methods for CVE-2021-36084

Indicators of Compromise

• Unexpected crashes or segmentation faults in the secilc CIL compiler process
• Core dumps containing stack traces referencing __cil_verify_classperms, __cil_verify_classpermission, or __cil_pre_verify_helper
• Anomalous CIL policy files with unusual classpermission constructs in compilation directories

Detection Strategies

• Monitor for crashes in SELinux policy compilation processes, particularly secilc and related tools
• Implement file integrity monitoring on CIL policy source directories to detect introduction of suspicious policy files
• Use AddressSanitizer (ASan) builds of SELinux tools in development and testing environments to catch use-after-free conditions

Monitoring Recommendations

• Enable core dump collection and analysis for SELinux compilation processes
• Monitor system logs for repeated policy compilation failures
• Implement alerting on unexpected terminations of secilc or policy compilation workflows

How to Mitigate CVE-2021-36084

Immediate Actions Required

• Update SELinux to a patched version that includes commit f34d3d30c8325e4847a6b696fe7a3936a8a361f3
• Review and restrict access to CIL policy compilation tools to trusted users only
• Avoid processing CIL policy files from untrusted or unknown sources
• Apply vendor-specific patches from Fedora, Debian, or NetApp as applicable to your environment

Patch Information

The vulnerability has been addressed in the official SELinux repository through commit f34d3d30c8325e4847a6b696fe7a3936a8a361f3. Distribution-specific patches are available through:

• Fedora Package Announcement for Fedora 35
• Debian LTS Security Announcement for Debian systems
• NetApp Security Advisory for affected NetApp products

Workarounds

• Restrict execution permissions for CIL compilation tools to administrative users only
• Implement mandatory code review for all CIL policy files before compilation
• Use containerized or sandboxed environments when compiling CIL policies from untrusted sources

# Restrict secilc to root/admin users only
chmod 750 /usr/bin/secilc
chown root:wheel /usr/bin/secilc

# Verify SELinux version includes the fix
rpm -q libsepol | grep -E "[0-9]+\.[0-9]+"