In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
apparmor: fix integer overflow in verify_tags() bounds check<\/p>\n
verify_tags() validates the tagset table unpacked from a policy blob.
\nFor each set it reads a count and checks that advancing the index by
\nthat count stays inside sets.table[]:<\/p>\n
\tu32 cnt = tags->sets.table[i];<\/p>\n
\tif (i+cnt >= tags->sets.size) {<\/p>\n
i, cnt and sets.size are all u32, so i+cnt is evaluated modulo 2^32.
\nsets.table[] is filled by unpack_tagsets() with aa_unpack_u32(), so
\nevery entry is a raw unbounded 32-bit word taken from the policy blob,
\nand verify_tags() is the function that is supposed to validate it. A
\ncount close to U32_MAX makes the sum wrap to a small value, the guard
\npasses, and the inner loop then walks sets.table[++i] past the end of
\nthe kcalloc(size, sizeof(u32)) allocation.<\/p>\n
Note that sets.size is bounded by 65535, because unpack_tagsets() reads
\nit with aa_unpack_array() as a u16, so the wrap cannot be reached by
\ngrowing the table; it is reached purely through the attacker-supplied
\ncount.<\/p>\n
With sets.size = 2 and sets.table = { 0, 0xffffffff }:<\/p>\n
i = 0: cnt = 0, guard 0 + 0 >= 2 is false, inner loop does not run
\n i = 1: cnt = 0xffffffff, guard (1 + 0xffffffff) mod 2^32 == 0 >= 2 is
\n false, so the guard is bypassed and the inner loop reads
\n sets.table[2] — one element past a two element allocation<\/p>\n
The walk continues until an out-of-bounds value happens to be >=
\nhdrs.size or the access faults, so a crafted policy yields an
\nout-of-bounds read on the policy load path
\n(aa_replace_profiles -> aa_unpack -> unpack_policydb -> unpack_tags ->
\nverify_tags). unpack_tags() runs before the perms and DFA tables are
\nunpacked, so no other table needs to be well formed to reach it.<\/p>\n
Policy load is gated by aa_may_manage_policy(), which checks
\nCAP_MAC_ADMIN relative to the subject’s own user namespace rather than
\nthe init user namespace, so with the default
\nunprivileged_userns_apparmor_policy=1 the path is reachable from an
\nunprivileged task in a matched-level nested namespace, not only by a
\nglobally privileged one.<\/p>\n
Perform the addition in u64 so that it cannot wrap, restoring the
\nintended i + cnt < sets.size guarantee.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
apparmor: fix integer overflow in verify_tags() bounds check<\/p>\n
verify_tags() validates the tagset table unpacked from a policy blob.<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25655","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}