Qualys Discloses Nine AppArmor Vulnerabilities in Linux

Security researchers at Qualys have disclosed nine vulnerabilities in the AppArmor Linux security module that could enable unprivileged local users to gain root access, bypass container isolation, and cause system crashes on millions of affected machines. The flaws, which have existed in the Linux kernel since version 4.11 released in 2017, impact widely used distributions including Ubuntu, Debian, and SUSE, where AppArmor is enabled by default.

Qualys's Threat Research Unit identified the issues, collectively known as CrackArmor, as stemming from a "confused deputy" design flaw. This allows an attacker with a standard local account to trick privileged system processes into unauthorized actions, such as manipulating AppArmor security profiles. These profiles enforce mandatory access controls to restrict application behavior and protect against threats, including zero-day exploits. By exploiting pseudofiles in the kernel, attackers can load, replace, or remove profiles without administrative credentials, researchers explained.

In one demonstrated scenario on a default Ubuntu Server installation, attackers could alter profiles to interfere with tools like Sudo and the Postfix mail...