Linux Kernel AppArmor TCP Fast Open Connection Mediation Vulnerability

A vulnerability in the Linux kernel's AppArmor security module allows a confined task to bypass connection mediation for outbound TCP connections using Fast Open. This issue arises because the AppArmor socket send message function only verifies the permission to send data, not to establish a connection. As a result, a profile that permits sending but denies connecting can exploit this oversight, particularly with TCP or Multipath TCP (MPTCP) connections. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability allows confined tasks to open outbound TCP or MPTCP connections that would normally be blocked, bypassing established security permissions.

Reproduction

To reproduce this vulnerability, create an AppArmor profile that allows the 'send' permission but denies 'connect'. Then, use a confined task to send a message over a TCP or MPTCP connection with the Fast Open option enabled. The connection should be established despite the 'connect' permission being denied, demonstrating the bypass.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for updating the kernel can be found in the official Linux documentation or through the package manager for your Linux distribution.