Re: [Bug] Double free vulnerability at define_genfs_context_helper

On Thu, Jul 9, 2026 at 2:57 PM COMS VLAB <[email protected]> wrote:
>
> Summary
>
> A double-free vulnerability exists in the checkpolicy source policy compiler's handling of genfscon statements. When parsing a new (previously unseen) filesystem type string, define_genfs_context_helper() transfers ownership of the fstype pointer into a genfs struct that is linked into the policydb's live genfs list, but fails to clear the local fstype variable afterward. If any subsequent parsing step in the same function fails, execution jumps to a shared fail: cleanup block. This cleanup block frees fstype, which leaves a dangling pointer in the genfs list. When the policydb is later destroyed via policydb_destroy(), it frees that same pointer again, causing the double-free.
>
>
>
> Version
>
> 06159ee35d6b4c968c1f942c9361c111644de826 - current version
>
>
>
> PoC: Please see attachment
>
>
>
> ASAN Report
>
> ==2502==ERROR: AddressSanitizer: attempting double-free on 0xfc1f82fe1330 in thread T0:
>
>     #0 0xaaaac9f6d518 in free (/selinux/repro+0xed518) (BuildId: ea3a1d5343a0633f08393e738125b8f44be83f66)
>
>     #1 0xaaaac9ffd49c in policydb_destroy selinux/libsepol/src/policydb.c:1596:3
>
>     #2 0xaaaac9faf758 in main selinux/../repro.c:11:5
>
>     #3 0xffff83c62f18  (/usr/lib/aarch64-linux-gnu/libc.so.6+0x22f18) (BuildId: b50ceafbd17dc6bceee344a66671c7eaa152bef4)
>
>     #4 0xffff83c63058 in __libc_start_main (/usr/lib/aarch64-linux-gnu/libc.so.6+0x23058) (BuildId: b50ceafbd17dc6bceee344a66671c7eaa152bef4)
>
>     #5 0xaaaac9ec7c6c in _start (selinux/repro+0x47c6c) (BuildId: ea3a1d5343a0633f08393e738125b8f44be83f66)
>
> 0xfc1f82fe1330 is located 0 bytes inside of 2-byte region [0xfc1f82fe1330,0xfc1f82fe1332)
>
> freed by thread T0 here:
>
>     #0 0xaaaac9f6d518 in free (/selinux/repro+0xed518) (BuildId: ea3a1d5343a0633f08393e738125b8f44be83f66)
>
>     #1 0xaaaac9fc8a60 in define_genfs_context_helper /selinux/checkpolicy/policy_define.c:6163:2
>
>     #2 0xaaaac9fc8a60 in define_genfs_context /selinux/checkpolicy/policy_define.c:6171:9
>
>     #3 0xaaaac9fcbc1c in yyparse /selinux/checkpolicy/policy_parse.y:787:30
>
>     #4 0xaaaac9fb95b4 in read_source_policy /selinux/checkpolicy/parse_util.c:70:6
>
>     #5 0xaaaac9faf750 in main /selinux/../repro.c:10:5
>
>     #6 0xffff83c62f18  (/usr/lib/aarch64-linux-gnu/libc.so.6+0x22f18) (BuildId: b50ceafbd17dc6bceee344a66671c7eaa152bef4)
>
>     #7 0xffff83c63058 in __libc_start_main (/usr/lib/aarch64-linux-gnu/libc.so.6+0x23058) (BuildId: b50ceafbd17dc6bceee344a66671c7eaa152bef4)
>
>     #8 0xaaaac9ec7c6c in _start (/selinux/repro+0x47c6c) (BuildId: ea3a1d5343a0633f08393e738125b8f44be83f66)
>
> previously allocated by thread T0 here:
>
>     #0 0xaaaac9f53a4c in strdup (/selinux/repro+0xd3a4c) (BuildId: ea3a1d5343a0633f08393e738125b8f44be83f66)
>
>     #1 0xaaaac9fb9aa0 in insert_id /selinux/checkpolicy/policy_define.c:131:10
>
>     #2 0xaaaac9fcc744 in yyparse /selinux/checkpolicy/policy_parse.y
>
>     #3 0xaaaac9fb95b4 in read_source_policy /selinux/checkpolicy/parse_util.c:70:6
>
>     #4 0xaaaac9faf750 in main /selinux/../repro.c:10:5
>
>     #5 0xffff83c62f18  (/usr/lib/aarch64-linux-gnu/libc.so.6+0x22f18) (BuildId: b50ceafbd17dc6bceee344a66671c7eaa152bef4)
>
>     #6 0xffff83c63058 in __libc_start_main (/usr/lib/aarch64-linux-gnu/libc.so.6+0x23058) (BuildId: b50ceafbd17dc6bceee344a66671c7eaa152bef4)
>
>     #7 0xaaaac9ec7c6c in _start (/selinux/repro+0x47c6c) (BuildId: ea3a1d5343a0633f08393e738125b8f44be83f66)
>
> SUMMARY: AddressSanitizer: double-free (/selinux/repro+0xed518) (BuildId: ea3a1d5343a0633f08393e738125b8f44be83f66) in free
>
> ==2502==ABORTING

Thanks for the report. Are you planning on submitting a patch for it?
How did you want us to attribute the report regardless?