In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
apparmor: fix use-after-free in rawdata dedup loop<\/p>\n
aa_replace_profiles() walks ns->rawdata_list to dedup the incoming
\npolicy blob against entries already attached to existing profiles.
\nPer the kernel-doc on struct aa_loaddata, list membership does not
\nhold a reference: profiles hold pcount, and when the last pcount
\ndrops, do_ploaddata_rmfs() is queued on a workqueue that takes
\nns->lock and removes the entry. Between dropping the last pcount
\nand the workqueue running, an entry remains on the list with
\npcount == 0.<\/p>\n
aa_get_profile_loaddata() is an unconditional kref_get() on
\npcount, so when the dedup loop hits such an entry, refcount
\nhardening reports<\/p>\n
refcount_t: addition on 0; use-after-free.<\/p>\n
inside aa_replace_profiles(), and the poisoned counter then
\ntrips “saturated” and “underflow” warnings on the subsequent
\nuses of the same loaddata.<\/p>\n
Before commit a0b7091c4de4 (“apparmor: fix race on rawdata
\ndereference”) the dedup path used a get_unless_zero-style helper
\non a single counter, so the existing “if (tmp)” guard was
\nmeaningful. The split-refcount refactor introduced
\naa_get_profile_loaddata(), which has plain kref_get() semantics,
\nand the guard quietly became a no-op.<\/p>\n
Introduce aa_get_profile_loaddata_not0(), matching the existing
\n_not0 convention used by aa_get_profile_not0(), and use it for
\nthe rawdata_list dedup lookup so dying entries are skipped.<\/p>\n
Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu
\n24.04 + stress-ng 0.17.06:<\/p>\n
stress-ng –apparmor 1 –klog-check –timeout 60s<\/p>\n
Without this patch the three refcount_t warnings fire within a
\nfew seconds. With it the same 60 s run is clean. Coverage is a
\nsmoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN
\nand CONFIG_PROVE_LOCKING would be welcome from anyone with the
\ncycles.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
apparmor: fix use-after-free in rawdata dedup loop<\/p>\n
aa_replace_profiles() walks ns->rawdata_list to dedup the incoming
\npolicy blob <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14898","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14898","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}