[Bug] Double free vulnerability at define_genfs_context_helper

Summary

A double-free vulnerability exists in the checkpolicy source policy
compiler's handling of genfscon statements. When parsing a new (previously
unseen) filesystem type string, define_genfs_context_helper() transfers
ownership of the fstype pointer into a genfs struct that is linked into the
policydb's live genfs list, but fails to clear the local fstype variable
afterward. If any subsequent parsing step in the same function fails,
execution jumps to a shared fail: cleanup block. This cleanup block frees
fstype, which leaves a dangling pointer in the genfs list. When the
policydb is later destroyed via policydb_destroy(), it frees that same
pointer again, causing the double-free.


Version

06159ee35d6b4c968c1f942c9361c111644de826 - current version
<https://github.com/SELinuxProject/selinux>


PoC: Please see attachment



ASAN Report

==2502==ERROR: AddressSanitizer: attempting double-free on 0xfc1f82fe1330
in thread T0:

    #0 0xaaaac9f6d518 in free (/selinux/repro+0xed518) (BuildId:
ea3a1d5343a0633f08393e738125b8f44be83f66)

    #1 0xaaaac9ffd49c in policydb_destroy
selinux/libsepol/src/policydb.c:1596:3

    #2 0xaaaac9faf758 in main selinux/../repro.c:11:5

    #3 0xffff83c62f18  (/usr/lib/aarch64-linux-gnu/libc.so.6+0x22f18)
(BuildId: b50ceafbd17dc6bceee344a66671c7eaa152bef4)

    #4 0xffff83c63058 in __libc_start_main
(/usr/lib/aarch64-linux-gnu/libc.so.6+0x23058) (BuildId:
b50ceafbd17dc6bceee344a66671c7eaa152bef4)

    #5 0xaaaac9ec7c6c in _start (selinux/repro+0x47c6c) (BuildId:
ea3a1d5343a0633f08393e738125b8f44be83f66)

0xfc1f82fe1330 is located 0 bytes inside of 2-byte region
[0xfc1f82fe1330,0xfc1f82fe1332)

freed by thread T0 here:

    #0 0xaaaac9f6d518 in free (/selinux/repro+0xed518) (BuildId:
ea3a1d5343a0633f08393e738125b8f44be83f66)

    #1 0xaaaac9fc8a60 in define_genfs_context_helper
/selinux/checkpolicy/policy_define.c:6163:2

    #2 0xaaaac9fc8a60 in define_genfs_context
/selinux/checkpolicy/policy_define.c:6171:9

    #3 0xaaaac9fcbc1c in yyparse /selinux/checkpolicy/policy_parse.y:787:30

    #4 0xaaaac9fb95b4 in read_source_policy
/selinux/checkpolicy/parse_util.c:70:6

    #5 0xaaaac9faf750 in main /selinux/../repro.c:10:5

    #6 0xffff83c62f18  (/usr/lib/aarch64-linux-gnu/libc.so.6+0x22f18)
(BuildId: b50ceafbd17dc6bceee344a66671c7eaa152bef4)

    #7 0xffff83c63058 in __libc_start_main
(/usr/lib/aarch64-linux-gnu/libc.so.6+0x23058) (BuildId:
b50ceafbd17dc6bceee344a66671c7eaa152bef4)

    #8 0xaaaac9ec7c6c in _start (/selinux/repro+0x47c6c) (BuildId:
ea3a1d5343a0633f08393e738125b8f44be83f66)

previously allocated by thread T0 here:

    #0 0xaaaac9f53a4c in strdup (/selinux/repro+0xd3a4c) (BuildId:
ea3a1d5343a0633f08393e738125b8f44be83f66)

    #1 0xaaaac9fb9aa0 in insert_id
/selinux/checkpolicy/policy_define.c:131:10

    #2 0xaaaac9fcc744 in yyparse /selinux/checkpolicy/policy_parse.y

    #3 0xaaaac9fb95b4 in read_source_policy
/selinux/checkpolicy/parse_util.c:70:6

    #4 0xaaaac9faf750 in main /selinux/../repro.c:10:5

    #5 0xffff83c62f18  (/usr/lib/aarch64-linux-gnu/libc.so.6+0x22f18)
(BuildId: b50ceafbd17dc6bceee344a66671c7eaa152bef4)

    #6 0xffff83c63058 in __libc_start_main
(/usr/lib/aarch64-linux-gnu/libc.so.6+0x23058) (BuildId:
b50ceafbd17dc6bceee344a66671c7eaa152bef4)

    #7 0xaaaac9ec7c6c in _start (/selinux/repro+0x47c6c) (BuildId:
ea3a1d5343a0633f08393e738125b8f44be83f66)

SUMMARY: AddressSanitizer: double-free (/selinux/repro+0xed518) (BuildId:
ea3a1d5343a0633f08393e738125b8f44be83f66) in free

==2502==ABORTING