CVE-2021-47218 selinux: fix NULL-pointer dereference when hashtab allocation fails

2024-04-1019:01:57

Linux

github.com

linux kernel

vulnerability resolved

selinux

AI Score

7.2

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

In the Linux kernel, the following vulnerability has been resolved:

selinux: fix NULL-pointer dereference when hashtab allocation fails

When the hash table slot array allocation fails in hashtab_init(),
h->size is left initialized with a non-zero value, but the h->htable
pointer is NULL. This may then cause a NULL pointer dereference, since
the policydb code relies on the assumption that even after a failed
hashtab_init(), hashtab_map() and hashtab_destroy() can be safely called
on it. Yet, these detect an empty hashtab only by looking at the size.

Fix this by making sure that hashtab_init() always leaves behind a valid
empty hashtab when the allocation fails.

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "03414a49ad5f",
        "lessThan": "b17dd53cac76",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "03414a49ad5f",
        "lessThan": "83c8ab8503ad",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "03414a49ad5f",
        "lessThan": "dc27f3c5d10c",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "security/selinux/ss/hashtab.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.8"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.8",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "5.10.82",
        "versionType": "custom",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.5",
        "versionType": "custom",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "5.16",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "security/selinux/ss/hashtab.c"
    ],
    "defaultStatus": "affected"
  }
]