All of lore.kernel.org
 help / color / mirror / Atom feed
From: James Carter <jwcart2@gmail.com>
To: Garrett Tucker <gtucker@redhat.com>
Cc: SElinux list <selinux@vger.kernel.org>
Subject: Re: libsepol CVE patch issue
Date: Fri, 23 Jul 2021 13:18:24 -0400	[thread overview]
Message-ID: <CAP+JOzT0++Kp1zNVDY77i92RcosdvC5hyFRQJ8vwmkCin1Ebig@mail.gmail.com> (raw)
In-Reply-To: <CAEN2sdo3wVKXnEUASFTbhR81kOYNgU1CbR0XMUNCTt8keOHC6A@mail.gmail.com>

On Fri, Jul 23, 2021 at 11:43 AM Garrett Tucker <gtucker@redhat.com> wrote:
>
> Hi everyone, I'm a product security engineer at Red Hat and we noticed
> that libsepol CVE-2021-36087 was assigned, and marked as resolved
> within the OSS-Fuzz project. The patch info provided for the CVE
> appears to be wrong, and after looking into the provided commits and
> commit ranges, these seem to be the wrong commits and commit ranges
> for this CVE.
>
> Would anyone be able to confirm if there is a fix for this CVE, and if
> so, point us towards the correct patch for this.
>

It is very hard to figure out what is going on in the policy provided
by the fuzzer. The best I can figure out is that the problem was
caused by something in an optional block that had been disabled and
deleted being referred to outside of the optional block. Removing all
of the optional blocks that are going to be disabled anyway eliminates
the problem, so that seems to confirm that idea.

This commit prevents that whole class of bugs from occurring.
340f0eb7f3673e8aacaf0a96cbfcd4d12a405521
libsepol/cil: Check for statements not allowed in optional blocks

The problem is definitely there before this patch. After this patch an
error is produced because a block is declared in an optional.

I hope that helps,
Jim


> All the best,
>
> Garrett
>

  reply	other threads:[~2021-07-23 17:18 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-23 15:42 libsepol CVE patch issue Garrett Tucker
2021-07-23 17:18 ` James Carter [this message]
2021-07-23 17:32   ` Garrett Tucker

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAP+JOzT0++Kp1zNVDY77i92RcosdvC5hyFRQJ8vwmkCin1Ebig@mail.gmail.com \
    --to=jwcart2@gmail.com \
    --cc=gtucker@redhat.com \
    --cc=selinux@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.