Re: [PATCH v3] libselinux: prevent ReDoS in file context regex matching

On Thu, Jul 30, 2026 at 1:23=E2=80=AFPM Stephen Smalley
<[email protected]> wrote:
>
> On Thu, Jul 30, 2026 at 10:05=E2=80=AFAM Petr Matyas <[email protected]=
m> wrote:
> >
> > The PCRE2 interpreter is susceptible to catastrophic backtracking on
> > crafted file context patterns or lookup keys. Since libselinux never
> > called pcre2_jit_compile(3), the JIT was available but unused, leaving
> > the interpreter exposed on all platforms.
> >
> > Fix with two complementary mitigations:
> >
> > 1. Call pcre2_jit_compile() after every pattern compilation (including
> >    mmap deserialization) for both complete and partial matching modes.
> >    pcre2_match() uses the JIT automatically when available, which avoid=
s
> >    the interpreter's susceptibility to catastrophic backtracking.
> >    Note: pcre2_jit_match() is deliberately NOT used as it is known to
> >    produce incorrect results on some platforms (e.g. aarch64).
> >
> > 2. Create a shared pcre2_match_context with a backtrack step limit of
> >    10 000 000 and pass it to pcre2_match(). PCRE2_ERROR_MATCHLIMIT is
> >    treated as no-match to keep the lookup safe rather than failing
> >    noisily. This bounds worst-case matching time to milliseconds for
> >    any pattern/subject combination, regardless of JIT availability.
> >
> > The vulnerability was reproduced and confirmed fixed on:
> > - RHIVOS 2.0 / aarch64
> > - RHEL 10.3 / x86_64
> > - Fedora 44 / x86_64
> >
> > Reproducer (149 bytes, base64):
> > AwovMi0GLy8GCygKeAYGKwYLKAoKCgAAAPpXKgsoCi8vBgs8PG5vbmU+PgovMi0GLy8GCyg=
KeAYG
> > KwYLKAoKCiNXLy8wCwsoCgojV1dXClcqCygKLy8vV1cueHhXV1d4eHgveCsGCygKCgonVy9=
XV3cy
> > eHgveAcGJAsoCi8tLwYvMi0GLy8GCzw8bm9uZT4+3q2+7y8=3D
> >
> > Signed-off-by: Petr Matyas <[email protected]>
>
> Acked-by: Stephen Smalley <[email protected]>

Merged.