Apparmor
Monthly
An integer overflow in the Linux kernel's AppArmor verify_tags() bounds check allows an authenticated local attacker with low privileges to trigger an out-of-bounds read by loading a crafted AppArmor policy blob, primarily causing a kernel crash and limited potential information disclosure. Reachability requires the ability to manage AppArmor policy; under the default unprivileged_userns_apparmor_policy=1 setting an unprivileged user in a matched-level nested user namespace can reach the path, otherwise CAP_MAC_ADMIN in the initial user namespace is required. The assessed vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, no public exploit was identified at time of analysis, and vendor patches exist.
AppArmor confinement escape in the Linux kernel allows a local user who is already confined by a profile stack to pass through an unconfined profile and break out of the enforced AppArmor security boundary, yielding high confidentiality and integrity impact with changed scope (CVSS 8.4, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The defect is that the unprivileged-transition restriction on unconfined is not applied when a task is already stacked, so the escape succeeds if two transitions through an unconfined profile can be executed; exploitation is local only, requires an existing confined/stacked context plus policy that permits such transitions, and therefore concentrates on hosts that deploy AppArmor with these restrictions (primarily Ubuntu and SUSE). Vendor-released patches exist for 6.18.52, 7.2.6 and 7.3-rc1, and no public exploit identified at time of analysis.
An issue was discovered in AppArmor before 2.12. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw.". Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.
An integer overflow in the Linux kernel's AppArmor verify_tags() bounds check allows an authenticated local attacker with low privileges to trigger an out-of-bounds read by loading a crafted AppArmor policy blob, primarily causing a kernel crash and limited potential information disclosure. Reachability requires the ability to manage AppArmor policy; under the default unprivileged_userns_apparmor_policy=1 setting an unprivileged user in a matched-level nested user namespace can reach the path, otherwise CAP_MAC_ADMIN in the initial user namespace is required. The assessed vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, no public exploit was identified at time of analysis, and vendor patches exist.
AppArmor confinement escape in the Linux kernel allows a local user who is already confined by a profile stack to pass through an unconfined profile and break out of the enforced AppArmor security boundary, yielding high confidentiality and integrity impact with changed scope (CVSS 8.4, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The defect is that the unprivileged-transition restriction on unconfined is not applied when a task is already stacked, so the escape succeeds if two transitions through an unconfined profile can be executed; exploitation is local only, requires an existing confined/stacked context plus policy that permits such transitions, and therefore concentrates on hosts that deploy AppArmor with these restrictions (primarily Ubuntu and SUSE). Vendor-released patches exist for 6.18.52, 7.2.6 and 7.3-rc1, and no public exploit identified at time of analysis.
An issue was discovered in AppArmor before 2.12. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw.". Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.