In the Linux kernel, the following vulnerability has been resolved:
apparmor: avoid crash when parsed profile name is empty
When processing a packed profile in unpack_profile() described like
"profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}"
a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aasplitnfqname().
aasplitnfqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aaallocprofile() crashes as the new profile name is NULL now.
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmorparser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aapolicyinit+0x1bb/0x230 aaallocprofile+0xb1/0x480 unpackprofile+0x3bc/0x4960 aaunpack+0x309/0x15e0 aareplaceprofiles+0x213/0x33c0 policyupdate+0x261/0x370 profilereplace+0x20e/0x2a0 vfswrite+0x2af/0xe00 ksyswrite+0x126/0x250 dosyscall64+0x46/0xf0 entrySYSCALL64after_hwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0
It seems such behaviour of aasplitnfqname() is expected and checked in other places where it is called (e.g. aaremoveprofiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside.
AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace.
Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message.
Found by Linux Verification Center (linuxtesting.org).
{ "vanir_signatures": [ { "id": "CVE-2023-52443-0e621274", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0392fdafb0a2321311900be83ffa572bef8203", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 7609.0, "function_hash": "312912577808697602214602349697769958635" }, "target": { "file": "security/apparmor/policy_unpack.c", "function": "unpack_profile" } }, { "id": "CVE-2023-52443-23027b1e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d8e62b5569cc1466ceb8a7e4872cf10160a9dcf", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "91286532375609681839429540116570562519", "136629512809386661870792534797397663938", "44269630258556176683263108468386844615", "305475541919696143477139295578289283868" ] }, "target": { "file": "security/apparmor/policy_unpack.c" } }, { "id": "CVE-2023-52443-2f27ac0f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9286ee97aa4803d99185768735011d0d65827c9e", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 6295.0, "function_hash": "232234816199748440169581677105208268586" }, "target": { "file": "security/apparmor/policy_unpack.c", "function": "unpack_profile" } }, { "id": "CVE-2023-52443-323f724a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d4fa5fe2b1d56662afd14915a73b4d0783ffa45", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "91286532375609681839429540116570562519", "136629512809386661870792534797397663938", "44269630258556176683263108468386844615", "305475541919696143477139295578289283868" ] }, "target": { "file": "security/apparmor/policy_unpack.c" } }, { "id": "CVE-2023-52443-36bb7d42", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d4fa5fe2b1d56662afd14915a73b4d0783ffa45", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 6810.0, "function_hash": "179194280856693267680724766313205174019" }, "target": { "file": "security/apparmor/policy_unpack.c", "function": "unpack_profile" } }, { "id": "CVE-2023-52443-4ec7405c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a12db736edbb4933e4274932aeea594b5876fa4", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "91286532375609681839429540116570562519", "136629512809386661870792534797397663938", "44269630258556176683263108468386844615", "305475541919696143477139295578289283868" ] }, "target": { "file": "security/apparmor/policy_unpack.c" } }, { "id": "CVE-2023-52443-67c3a402", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77ab09b92f16c8439a948d1af489196953dc4a0e", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 6954.0, "function_hash": "106553577412930147556364117225647410696" }, "target": { "file": "security/apparmor/policy_unpack.c", "function": "unpack_profile" } }, { "id": "CVE-2023-52443-717ed2ed", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9286ee97aa4803d99185768735011d0d65827c9e", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "91286532375609681839429540116570562519", "136629512809386661870792534797397663938", "44269630258556176683263108468386844615", "305475541919696143477139295578289283868" ] }, "target": { "file": "security/apparmor/policy_unpack.c" } }, { "id": "CVE-2023-52443-720a5371", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d8e62b5569cc1466ceb8a7e4872cf10160a9dcf", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 6394.0, "function_hash": "11098891955444553232002202326633794531" }, "target": { "file": "security/apparmor/policy_unpack.c", "function": "unpack_profile" } }, { "id": "CVE-2023-52443-8a1d2ea9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a12db736edbb4933e4274932aeea594b5876fa4", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 6652.0, "function_hash": "123458531956904781312447754608938545090" }, "target": { "file": "security/apparmor/policy_unpack.c", "function": "unpack_profile" } }, { "id": "CVE-2023-52443-a72f2c33", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0392fdafb0a2321311900be83ffa572bef8203", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "91286532375609681839429540116570562519", "136629512809386661870792534797397663938", "44269630258556176683263108468386844615", "305475541919696143477139295578289283868" ] }, "target": { "file": "security/apparmor/policy_unpack.c" } }, { "id": "CVE-2023-52443-c0ae9953", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55a8210c9e7d21ff2644809699765796d4bfb200", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 6954.0, "function_hash": "106553577412930147556364117225647410696" }, "target": { "file": "security/apparmor/policy_unpack.c", "function": "unpack_profile" } }, { "id": "CVE-2023-52443-cccb2d15", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ff00408e5029d3550ee77f62dc15f1e15c47f87", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 6652.0, "function_hash": "123458531956904781312447754608938545090" }, "target": { "file": "security/apparmor/policy_unpack.c", "function": "unpack_profile" } }, { "id": "CVE-2023-52443-dd7c7e9c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77ab09b92f16c8439a948d1af489196953dc4a0e", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "91286532375609681839429540116570562519", "136629512809386661870792534797397663938", "44269630258556176683263108468386844615", "305475541919696143477139295578289283868" ] }, "target": { "file": "security/apparmor/policy_unpack.c" } }, { "id": "CVE-2023-52443-e0db7b25", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55a8210c9e7d21ff2644809699765796d4bfb200", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "91286532375609681839429540116570562519", "136629512809386661870792534797397663938", "44269630258556176683263108468386844615", "305475541919696143477139295578289283868" ] }, "target": { "file": "security/apparmor/policy_unpack.c" } }, { "id": "CVE-2023-52443-f075113b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ff00408e5029d3550ee77f62dc15f1e15c47f87", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "91286532375609681839429540116570562519", "136629512809386661870792534797397663938", "44269630258556176683263108468386844615", "305475541919696143477139295578289283868" ] }, "target": { "file": "security/apparmor/policy_unpack.c" } } ] }