Description
In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb_class_isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate. Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
55fcf09b3fe4325c9395ebbb0322a547a157ebc7 to < d2e7f7035d6f407119ba5467f7218cc4370844fcaffected55fcf09b3fe4325c9395ebbb0322a547a157ebc7 to < f38a71868888285efc9c0ab5b032e23919c5a0a1affected55fcf09b3fe4325c9395ebbb0322a547a157ebc7 to < 3480c081c23d559fd9a6921b76955664f2e95153affected55fcf09b3fe4325c9395ebbb0322a547a157ebc7 to < e0285bb152211c00900136b66d4b420c14a59094affected55fcf09b3fe4325c9395ebbb0322a547a157ebc7 to < 099869e9343a5f8c22b58497f074b34f63cbf856affected55fcf09b3fe4325c9395ebbb0322a547a157ebc7 to < 841aea4d5a25e16273d04cd07a74142b4687e03baffected55fcf09b3fe4325c9395ebbb0322a547a157ebc7 to < d8a10899ea3c84b80de72ca8ee9039e9a5156c9aaffected55fcf09b3fe4325c9395ebbb0322a547a157ebc7 to < 22b05fec62c0fe9864cfceb52f7d0f3a34d9b1ddaffected
Linux Linux
Default version status: affected
2.6.23affected0 to < 2.6.23unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.153 to ≤ 6.6.*unaffected6.12.105 to ≤ 6.12.*unaffected6.18.46 to ≤ 6.18.*unaffected7.1.10 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d2e7f7035d6f407119ba5467f7218cc4370844fc ↗
- https://git.kernel.org/stable/c/f38a71868888285efc9c0ab5b032e23919c5a0a1 ↗
- https://git.kernel.org/stable/c/3480c081c23d559fd9a6921b76955664f2e95153 ↗
- https://git.kernel.org/stable/c/e0285bb152211c00900136b66d4b420c14a59094 ↗
- https://git.kernel.org/stable/c/099869e9343a5f8c22b58497f074b34f63cbf856 ↗
- https://git.kernel.org/stable/c/841aea4d5a25e16273d04cd07a74142b4687e03b ↗
- https://git.kernel.org/stable/c/d8a10899ea3c84b80de72ca8ee9039e9a5156c9a ↗
- https://git.kernel.org/stable/c/22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd ↗