3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2021-36085

CVE-2021-36085: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from...

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2021-36085

CVE-2021-36085:

3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis focused on the provided commit 2d35fcc7e9e976a2346b1de20e54f8663e8a6cba, which addresses a use-after-free vulnerability. The commit modifies the function cil_reset_perm in the file libsepol/cil/src/cil_reset_ast.c. The vulnerability stemmed from the incorrect handling of the classperms list associated with permissions, particularly map permissions, during an AST reset. The pre-patch version of cil_reset_perm called cil_reset_classperms_list(perm->classperms). This call is identified as the source of the vulnerability because its removal and replacement fixed the issue. The commit message clarifies that for map permissions, the classperms list data is not owned by the permission itself and should not be destroyed when the list is reset; only the list structure should be. The previous handling presumably led to the data being improperly freed or the list being managed in a way that resulted in dangling pointers. This incorrect memory management within cil_reset_perm set up the conditions for a use-after-free. The vulnerability description (CVE-2021-36085) states that this use-after-free occurs in __cil_verify_classperms (which is called from __verify_map_perm_classperms and hashtab_map). While __cil_verify_classperms is where the UAF manifests (i.e., where the crash would likely occur and be observed in a stack trace), the root cause of the vulnerability—the incorrect memory management—was located in the logic of cil_reset_perm. The patch directly addresses this by changing how cil_reset_perm handles the classperms list, replacing the problematic call with cil_list_destroy(&perm->classperms, CIL_FALSE), ensuring the list is destroyed without freeing the data elements it doesn't own. Therefore, cil_reset_perm is identified as the vulnerable function because it contained the flawed logic that was corrected by the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.