Linux Kernel AppArmor Double Free Vulnerability in Profile Replacement Function

A double free vulnerability has been identified in the Linux kernel's AppArmor subsystem, specifically within the profile replacement function. This issue arises when the 'ns_name' variable is NULL after unpacking user data, leading to a situation where 'ns_name' is assigned from an entity that has already been freed. The vulnerability affects the stable versions of the Linux kernel.

Impact

Exploitation of this vulnerability could lead to memory corruption issues, commonly associated with double free vulnerabilities, which can be exploited to execute arbitrary code or cause a denial of service.

Reproduction

The vulnerability can be reproduced by loading an AppArmor policy that includes namespaces, while the 'ns_name' is NULL. This triggers the unpacking of user data, followed by a double free when the 'ns_name' is assigned from an entity that is subsequently freed.

Remediation

Users can upgrade to the latest stable version of the Linux kernel to address this vulnerability.