CVE-2021-36087
First published: Thu Jul 01 2021(Updated: )
SELinux Project SELinux is vulnerable to a denial of service, caused by a heap-based buffer over-read in ebitmap_match_any. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SELinux Project SELinux | =3.2 | |
| Fedoraproject Fedora | =35 | |
| IBM QRadar SIEM | <=7.5.0 GA | |
| IBM QRadar SIEM | <=7.4.3 GA - 7.4.3 FP4 | |
| IBM QRadar SIEM | <=7.3.3 GA - 7.3.3 FP10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32675
- https://github.com/SELinuxProject/selinux/commit/340f0eb7f3673e8aacaf0a96cbfcd4d12a405521
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-585.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U7ZYR3PIJ75N6U2IONJWCKZ5L2NKJTGR/
- https://lore.kernel.org/selinux/CAEN2sdqJKHvDzPnxS-J8grU8fSf32DDtx=kyh84OsCq_Vm+yaQ@mail.gmail.com/T/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/204796
- https://www.ibm.com/support/pages/node/6574787 (Advisory)
- https://lore.kernel.org/selinux/CAEN2sdqJKHvDzPnxS-J8grU8fSf32DDtx=kyh84OsCq_Vm+yaQ%40mail.gmail.com/T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U7ZYR3PIJ75N6U2IONJWCKZ5L2NKJTGR/
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-36087.
What is the severity of CVE-2021-36087?
The severity of CVE-2021-36087 is medium.
What is the affected software for CVE-2021-36087?
The affected software for CVE-2021-36087 is IBM QRadar SIEM version 7.5.0 GA, 7.4.3 GA - 7.4.3 FP4, and 7.3.3 GA - 7.3.3 FP10.
How can I fix CVE-2021-36087?
You can fix CVE-2021-36087 by applying the patch provided by IBM. Please refer to the links in the references section for the patches.
Where can I find more information about CVE-2021-36087?
You can find more information about CVE-2021-36087 at the IBM X-Force Exchange and the IBM Support page. Please refer to the links in the references section.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/author
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/tags
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/selinux project
- canonical/selinux project selinux
- version/selinux project selinux/3.2
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- vendor/ibm
- canonical/ibm qradar siem
- version/ibm qradar siem/7.5.0 ga
- version/ibm qradar siem/7.4.3 ga - 7.4.3 fp4
- version/ibm qradar siem/7.3.3 ga - 7.3.3 fp10