ZeroDay Findings
Sign inSign up

Findings

CVE-2021-36087

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow).

Published Jul 1, 2021 · updated Oct 14, 2026 · selinux project selinux

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 1, 2021 · NIST NVD

    Detected

    The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

  2. Oct 14, 2026 · NIST NVD

    Updated

    The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Affected

  • cpe fedoraproject/fedora35
  • cpe selinux project/selinux3.2

Sources

  • CVE.orgVulnerability recordCVE-2021-36087

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-36087

    30-day exploitation probability 0.5%

    first.org
  • NIST NVDVulnerability recordCVE-2021-36087

    The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

    nvd.nist.gov

References