Linux Kernel AppArmor Use-After-Free Vulnerability in Profile Loading

A use-after-free vulnerability has been identified in the Linux kernel's AppArmor subsystem, specifically within the profile loading process. This issue arises in versions of the Linux kernel prior to the patch included in version 7.1-rc5. The vulnerability is rooted in how the kernel manages reference counts for profile data. When the last reference count drops, the entry is removed from the raw data list, but a brief window exists where the entry can be accessed again, leading to a use-after-free condition. This was exacerbated by a recent refactor that changed how reference counts are handled, introducing a race condition that could be exploited. The vulnerability was reproduced in a QEMU/KVM environment running Ubuntu 24.04, using the stress-ng tool to simulate the conditions necessary for exploitation.

Impact

Exploitation of this vulnerability causes a use-after-free condition, which can lead to memory corruption issues commonly associated with such vulnerabilities, potentially allowing for arbitrary code execution or other unintended behavior.

Reproduction

The vulnerability can be reproduced on x86_64 systems running Linux 7.1-rc5, within a QEMU+KVM environment on Ubuntu 24.04. The 'stress-ng' tool, version 0.17.06, can be used to trigger the vulnerability by applying stress to the AppArmor subsystem, which exposes the use-after-free condition by manipulating the reference counts of the AppArmor profile data.

Remediation

Users can upgrade to the latest stable version of the Linux kernel to address this vulnerability. The specific commit that fixes this issue is included in the Linux kernel version 7.1-rc5.