Qualys has identified 9 vulnerabilities in the AppArmor mandatory access control system, the most critical of which allow a local unprivileged user to gain root privileges on the system, escape from isolated containers, and bypass restrictions imposed through AppArmor. The vulnerabilities have been codenamed CrackArmor. CVE identifiers have not yet been assigned. Successful examples of privilege escalation have been demonstrated in Ubuntu 24.04 and Debian 13.
The issues are present in the AppArmor LSM module since the Linux kernel 4.11 released in 2017, and they manifest in distributions using AppArmor, such as Ubuntu, Debian, openSUSE, and SUSE (with SELinux enabled by default starting from openSUSE/SUSE 16, but AppArmor remains an option). Patches addressing the vulnerabilities have been sent to the Linux kernel developers and will be offered to users shortly as part of updates 6.18.18, 6.19.8, 6.12.77, 6.6.130, 6.1.167, 5.15.203, and 5.10.253. A fix is also included in today’s package updates for the kernel for Ubuntu. Additionally, updates for sudo, sudo-ldap, and util-linux packages (which includes the su utility) have been released in Ubuntu, fixing shortcomings that allowed the AppArmor vulnerability to be exploited. An update for Debian is in preparation.
The issues are due to a fundamental vulnerability in AppArmor called the 'confused deputy' that allows unprivileged users to load, replace, and delete arbitrary AppArmor profiles. This vulnerability can directly be exploited to disable protection for programs and services against local and remote attacks (through writing to pseudo-files /sys/kernel/security/apparmor/.load, .replace, and .remove, for instance, to lift restrictions in cupsd and rsyslogd), trigger denial of service (by applying blocking profiles), and bypass namespace restrictions (through loading a new AppArmor profile 'userns', for example, for /usr/bin/time, allowing the creation of unlimited user namespaces).
The ability to replace AppArmor profiles also allows for gaining root privileges by binding new profiles that block access to certain system calls to privileged utilities such as su and sudo. In particular, root access can be obtained by blocking the setuid operation (CAP_SETUID) for the sudo utility in combination with manipulating the MAIL_CONFIG environment variable to change the directory with mail settings. server Postfix.
The essence of the method is that when issues arise, the sudo utility sends an email to the administrator by invoking /usr/sbin/sendmail. By blocking privilege dropping, this process can be executed with root privileges, and by setting the MAIL_CONFIG environment variable before running sudo, other settings can be passed to the sendmail utility, including specifying a custom postdrop handler to be executed when sending mail. $ mkdir /tmp/postfix $ cat > /tmp/postfix/main.cf < /tmp/postfix/postdrop <> /tmp/postfix/pwned EOF $ chmod -R 0755 /tmp/postfix $ apparmor_parser -K -o sudo.pf < /sys/kernel/security/apparmor/.replace Password: $ env -i MAIL_CONFIG=/tmp/postfix /usr/bin/sudo whatever sudo: PERM_SUDOERS: setresuid(-1, 1, -1): Operation not permitted sudo: unable to open /etc/sudoers: Operation not permitted sudo: setresuid() [0, 0, 0] -> [1001, -1, -1]: Operation not permitted sudo: error initializing audit plugin sudoers_audit $ cat /tmp/postfix/pwned uid=0(root) gid=1001(jane) groups=1001(jane),100(users)
Other methods of privilege escalation include vulnerabilities in the AppArmor code that runs at the Linux kernel level. It has been shown how to gain root privileges through vulnerabilities caused by double execution of the free() function and access to already freed memory (use-after-free) in the code for loading and replacing AppArmor profiles. For example, AppArmor saves the profile in the aa_loaddata structure, for which memory is allocated in the slab cache kmalloc-192, and due to a race condition, it is possible to access the memory once occupied by the structure after it has been freed. This issue can be exploited to gain control over freed memory and reallocate the freed memory page to map the contents of the /etc/passwd file and overwrite the root password line.
Source: opennet.ru
