Every CVE Search/ Get API key

CVE-2021-36087

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called...

3.3 LowFix available

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.47%Down 0.4 points since Jul 1, 2021
90%50%10%1%

What each source reports

NVD Score used 3.3

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Record
CVE-2021-36087
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Record
CVE-2021-36087
Updated
2026-11-02
EUVDEUVD-2021-22720 No score

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Record
EUVD-2021-22720
Updated
2026-11-02
GitHub AdvisoriesGHSA-xjc2-37xp-26m5 3.3

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called...

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). NOTE: bad0a746e9f4cf260dedba5828d9645d50176aac is cited in the OSV "fixed" field but does not have a code change.

Record
GHSA-xjc2-37xp-26m5
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
OSV 3.3

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Record
CVE-2021-36087
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2021-36087 3.3

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Record
DEBIAN-CVE-2021-36087
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2021:4513 3.3

Red Hat Security Advisory: libsepol security update

Record
RHSA-2021:4513
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2021:4513 3.3

Moderate: libsepol security update

The libsepol library provides an API for the manipulation of SELinux binary policies. It is used by checkpolicy (the policy compiler) and similar tools, as well as by programs like load_policy that need to perform specific transformations on binary policies (for example, customizing policy boolean settings).

Security Fix(es):

  • libsepol: use-after-free in __cil_verify_classperms() (CVE-2021-36084)

  • libsepol: use-after-free in __cil_verify_classperms() (CVE-2021-36085)

  • libsepol: use-after-free in cil_reset_classpermission() (CVE-2021-36086)

  • libsepol: heap-based buffer overflow in ebitmap_match_any() (CVE-2021-36087)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Record
RLSA-2021:4513
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2021-36087 3.3

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Record
UBUNTU-CVE-2021-36087
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2021:4513 No score

Moderate: libsepol security update

The libsepol library provides an API for the manipulation of SELinux binary policies. It is used by checkpolicy (the policy compiler) and similar tools, as well as by programs like load_policy that need to perform specific transformations on binary policies (for example, customizing policy boolean settings).

Security Fix(es):

  • libsepol: use-after-free in __cil_verify_classperms() (CVE-2021-36084)

  • libsepol: use-after-free in __cil_verify_classperms() (CVE-2021-36085)

  • libsepol: use-after-free in cil_reset_classpermission() (CVE-2021-36086)

  • libsepol: heap-based buffer overflow in ebitmap_match_any() (CVE-2021-36087)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2021:4513
Updated
2026-11-02
OSVopenSUSE-SU-2024:10990-1 No score

libsepol-devel-3.2-3.2 on GA media

These are all security issues fixed in the libsepol-devel-3.2-3.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10990-1
Updated
2026-11-02
OSVUSN-5391-1 No score

libsepol vulnerabilities

Nicolas Iooss discovered that libsepol incorrectly handled memory when handling policies. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-36084)

It was discovered that libsepol incorrectly handled memory when handling policies. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-36085)

It was discovered that libsepol incorrectly handled memory when handling policies. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affects Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2021-36086)

It was discovered that libsepol incorrectly validated certain data, leading to a heap overflow. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-36087)

Record
USN-5391-1
Updated
2026-11-02

Affected products

Show 4 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
libsepol
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.9-3.el8
2.9-3.el8
libsepol-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.9-3.el8
2.9-3.el8
libsepol-static
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.9-3.el8
2.9-3.el8
libsepol
Debian:12
 before 3.3-1
3.3-1
libsepol
Debian:13
 before 3.3-1
3.3-1
libsepol
Debian:14
 before 3.3-1
3.3-1
libsepol
Debian:11
From an advisory covering 4 CVEs
 before 3.1-1+deb11u1, plus listed versions
3.1-1
3.1-1+deb11u1
libsepol
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.9-3.el8
0:2.9-3.el8
libsepol-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.9-3.el8
0:2.9-3.el8
libsepol-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.9-3.el8
0:2.9-3.el8
Show 11 moreShow less
Affected packages
PackageAffectedFixed
libsepol-devel
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.9-3.el8
0:2.9-3.el8
libsepol-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:2.9-3.el8
0:2.9-3.el8
libsepol-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:2.9-3.el8
0:2.9-3.el8
libsepol-static
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:2.9-3.el8
0:2.9-3.el8
libsepol
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:2.9-3.el8
0:2.9-3.el8
libsepol
Ubuntu:Pro:16.04:LTS
 before 2.4-2ubuntu0.1~esm1, plus listed versions
2.3-22.4-2
2.4-2ubuntu0.1~esm1
libsepol
Ubuntu:18.04:LTS
 before 2.7-1ubuntu0.1, plus listed versions
2.7-1
2.7-1ubuntu0.1
libsepol
Ubuntu:20.04:LTS
 before 3.0-1ubuntu0.1, plus listed versions
2.9-23.0-1
3.0-1ubuntu0.1
libsepol
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 2.4-2ubuntu0.1~esm1, plus listed versions
2.3-22.4-2
2.4-2ubuntu0.1~esm1
libsepol
Ubuntu:18.04:LTS
From an advisory covering 4 CVEs
 before 2.7-1ubuntu0.1, plus listed versions
2.7-1
2.7-1ubuntu0.1
libsepol
Ubuntu:20.04:LTS
From an advisory covering 4 CVEs
 before 3.0-1ubuntu0.1, plus listed versions
2.9-23.0-1
3.0-1ubuntu0.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-36087 is a low vulnerability (CVSS 3.3) in Selinux Project Selinux, published July 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in libsepol 3.3-1.

References

Show 42 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open