Executive brief
AppArmor is a Linux security module that enforces mandatory access control policies. A vulnerability in the policy validation code allows an attacker with the ability to load policies in a user namespace to trigger an out-of-bounds memory read by crafting a malicious policy file. This could lead to information disclosure or system instability.
Technical details
The verify_tags() function in AppArmor contains an integer overflow vulnerability in its bounds check. The function validates tag counts read from a policy blob using 32-bit unsigned integers (u32) for the index i, count cnt, and table size. When i + cnt is computed using u32 arithmetic, an attacker-supplied cnt value close to U32_MAX causes the addition to wrap modulo 2^32, bypassing the guard check "i + cnt >= sets.size". This allows the inner loop to read beyond the allocated memory of sets.table[]. The vulnerability is reachable via the policy load path (aa_replace_profiles → unpack_policydb → unpack_tags → verify_tags) from unprivileged tasks in nested user namespaces when unprivileged_userns_apparmor_policy is enabled. The fix performs the addition in u64 arithmetic to prevent wrapping.
Affected products
- Linux Linux kernel <unknown version with fix
Timeline
- 2026-09-17: disclosed
- <UNKNOWN>: patched: Fix applies u64 arithmetic in verify_tags() bounds check