CVE-2023-52443: apparmor: avoid crash when parsed profile name is empty
In the Linux kernel, the following vulnerability has been resolved:
apparmor: avoid crash when parsed profile name is empty
When processing a packed profile in unpackprofile() described like
"profile :ns::samba-dcerpcd /usr/lib/samba/{,samba/}samba-dcerpcd {...}"
a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aasplitnfqname().
aasplitnfqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aaallocprofile() crashes as the new profile name is NULL now.
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmorparser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aapolicyinit+0x1bb/0x230 aaallocprofile+0xb1/0x480 unpackprofile+0x3bc/0x4960 aaunpack+0x309/0x15e0 aareplaceprofiles+0x213/0x33c0 policyupdate+0x261/0x370 profilereplace+0x20e/0x2a0 vfswrite+0x2af/0xe00 ksyswrite+0x126/0x250 dosyscall64+0x46/0xf0 entrySYSCALL64afterhwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0
It seems such behaviour of aasplitnfqname() is expected and checked in other places where it is called (e.g. aaremoveprofiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside.
AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace.
Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message.
Found by Linux Verification Center (linuxtesting.org).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52443?
The severity of CVE-2023-52443 has not been explicitly stated, but it concerns a potential crash in the Linux kernel's AppArmor functionality.
How do I fix CVE-2023-52443?
To fix CVE-2023-52443, upgrade to the patched versions provided in the Linux kernel updates such as 5.10.223-1 or higher.
Which versions of the Linux kernel are affected by CVE-2023-52443?
CVE-2023-52443 affects Linux kernel versions from 4.19.306 up to but not including 6.7.0.
What does CVE-2023-52443 vulnerability affect?
CVE-2023-52443 affects the AppArmor feature in the Linux kernel, specifically the handling of empty profile names.
Is CVE-2023-52443 a remote attack vulnerability?
CVE-2023-52443 is not categorized as a remote attack vulnerability as it involves a local system configuration issue.