CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's SELinux implementation, where an out-of-bounds heap write can occur due to improper validation of permission values against the number of defined permissions for a class. This flaw could lead to potential memory corruption and exploitation if a policy declares a permission value that exceeds the defined limits. Organizations using SELinux in their Linux environments should prioritize addressing this issue to mitigate risks associated with policy misconfigurations.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count perm_read() bounds a permission value by SEL_VEC_MAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image. security_get_permissions() then writes perms[value - 1] into an nprim-sized kcalloc() array, so a class declaring fewer permissions than its largest permission value drives an out-of-bounds heap write. The top-level symbol tables are validated this way; the nested per-class permission table is not. Reject a permission whose value exceeds nprim, which is already set when perm_read() runs. Well-formed policies are unaffected. [PM: tweak comment for line length]