Multiple Vulnerabilities in AppArmor AKA CrackArmor
Summary #
On 12 March, Qualys Threat Research disclosed multiple vulnerabilities in the Linux Mandatory Access Control (MAC) framework AppArmor, both in the Linux kernel as well as the AppArmor implementation on popular Linux distributions including Ubuntu, Debian and SUSE. A successful attack involving these vulnerabilities could allow a threat actor with access to the local filesystem to escalate their privileges to Root, bypass MAC policies, or execute a Denial of Service against the vulnerable system.
Both Dimension v2.3 and WebBlockerServer v2.1 run on an effected version of the Ubuntu operating system. While both Dimension and WebBlocker received automated security updates through the built-in unattended upgrades utility, Linux kernel patches are not available through this utility and must instead be manually installed.
CVE identifiers #
| CVE ID | Description | CVSS |
|---|---|---|
| CVE-2026-23268 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process to write to the interface. This does require a privileged target that can be manipulated to do the write for the unprivileged process, but once such access is achieved full policy management is possible and all the possible implications that implies: removing confinement, DoS of system or target applications by denying all execution, by-passing the unprivileged user namespace restriction, to exploiting kernel bugs for a local privilege escalation. The policy management interface can not have its permissions simply changed from 0666 to 0600 because non-root processes need to be able to load policy to different policy namespaces. Instead ensure the task writing the interface has privileges that are a subset of the task that opened the interface. This is already done via policy for confined processes, but unconfined can delegate access to the opened fd, by-passing the usual policy check. | 7.8 |
| CVE-2026-23269 | In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ... Reject policies with out-of-bounds start states during unpacking to prevent the issue. | 7.1 |
Product status #
| Product | Affected | Not affected |
|---|---|---|
| Dimension | All versions | — |