Description
In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 4d0ece18e648bd4362704fd087249ac697f2b7fbaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 4dfb997c60f7951011d3dcbee926e3a7f80d8a76affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 740012aebdb8311332bf66e2aabf453ba73c2c45affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 42a7107f99d86a7524c37f108047dfa3db096ab5affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < ed901e88aa3fb3d5d7b0b52c2ee3073209df9becaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < a93d37a09b863810653f93d371fb197457d59debaffected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.266 to ≤ 5.10.*unaffected5.15.217 to ≤ 5.15.*unaffected6.1.184 to ≤ 6.1.*unaffected6.6.153 to ≤ 6.6.*unaffected6.12.105 to ≤ 6.12.*unaffected6.18.46 to ≤ 6.18.*unaffected7.1.10 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4d0ece18e648bd4362704fd087249ac697f2b7fb ↗
- https://git.kernel.org/stable/c/3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8 ↗
- https://git.kernel.org/stable/c/4dfb997c60f7951011d3dcbee926e3a7f80d8a76 ↗
- https://git.kernel.org/stable/c/3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40 ↗
- https://git.kernel.org/stable/c/740012aebdb8311332bf66e2aabf453ba73c2c45 ↗
- https://git.kernel.org/stable/c/42a7107f99d86a7524c37f108047dfa3db096ab5 ↗
- https://git.kernel.org/stable/c/ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec ↗
- https://git.kernel.org/stable/c/a93d37a09b863810653f93d371fb197457d59deb ↗