Executive brief
AppArmor is a Linux kernel security module that enforces application access policies. A memory leak in AppArmor's namespace initialization can cause kernel memory to accumulate over time, leading to potential denial of service if enough memory is exhausted. This is a low-risk issue that primarily affects long-running systems where many namespaces are allocated.
Technical details
A memory leak exists in the alloc_ns() function within the AppArmor security module (security/apparmor/policy_ns.c). After commit a1bd627b46d1, the hname member of struct aa_policy became a pointer to a substring within a larger allocated object rather than a standalone slab allocation. The vulnerable code incorrectly attempted to free hname using kfree_sensitive(), which is inappropriate for non-slab pointers. The fix replaces the incorrect kfree_sensitive(ns->base.hname) call with aa_policy_destroy(&ns->base), which properly handles cleanup of the entire policy structure. This is a kernel-level issue triggered during AppArmor namespace allocation failures, requiring no special privileges or network access.
Affected products
- Linux Linux kernel Versions after commit a1bd627b46d1
Timeline
- 2025-12-30: disclosed
- 2022-12-31: patched: Fix applied upstream in commit e9e6fa49dbab6d84c676666f3fe7d360497fd65b