Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-89761

apparmor: fix out-of-bounds write when null terminating a label vec

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the terminator goes to vec[n], so the caller has to provide room for n + 1 entries. aa_label_strn_parse() sets up its vector with vec_setup(profile, vec, len, gfp) and then calls aa_vec_unique(vec, len, VEC_FLAG_TERMINATE), but vec_setup() does not reserve the terminator entry. Up to LOCAL_VEC_ENTRIES it uses the local array of LOCAL_VEC_ENTRIES pointers, above that it allocates exactly len pointers. The terminator therefore lands one entry past the end of the local array when len is LOCAL_VEC_ENTRIES, and one entry past the end of the allocation when len is larger. len comes from the number of "//&" separated components in the label name and label_count_strn_entries() does not bound it. An unprivileged task reaches the parse by writing to /proc/self/attr/apparmor/current or through lsm_set_self_attr(2), both of which go through do_setattr(), and the name is parsed before the change_profile permission is checked. The query_label() path behind the securityfs .access file, which is mode 0666, performs no permission check at all. Every component has to resolve to a loaded profile, so a system with policy loaded is required. The other two VEC_FLAG_TERMINATE users work on a label vec that aa_label_alloc() has already sized with "+ 1 for null terminator entry on vec". Reserve the same entry in vec_setup() and DEFINE_VEC(). Passing len + 1 from the caller instead would move len == LOCAL_VEC_ENTRIES out of the local array and into kzalloc().

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • f1bd904175e8190ce14aedee37e207ab51fe3b30 to < 0d4cb3af82556afc48f90fd3e8a126ff32343f41affected
  • f1bd904175e8190ce14aedee37e207ab51fe3b30 to < 40fdee1cb4f18e6a1a21a891ae4735bcd4d35026affected
  • f1bd904175e8190ce14aedee37e207ab51fe3b30 to < 57bb24025f450728f342d8e08cd3909c89361d90affected
  • f1bd904175e8190ce14aedee37e207ab51fe3b30 to < b17c8f5dcb36a032688847b2bce4bd813b4baad1affected
  • f1bd904175e8190ce14aedee37e207ab51fe3b30 to < 9124e078ea2250d8d01d2162a550acb01ef5bf48affected
  • f1bd904175e8190ce14aedee37e207ab51fe3b30 to < 28069434aef66b9d084f0609b7a29c171846815eaffected
  • f1bd904175e8190ce14aedee37e207ab51fe3b30 to < 36bdd0b45ec3f4822832a56e9db8674c8450dfceaffected
  • f1bd904175e8190ce14aedee37e207ab51fe3b30 to < 9f1e40193eef7f047e6b77cfb4b4cafdecd7a123affected

Linux Linux

Default version status: affected

  • 4.13affected
  • 0 to < 4.13unaffected
  • 5.10.273 to ≤ 5.10.*unaffected
  • 5.15.224 to ≤ 5.15.*unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.109 to ≤ 6.12.*unaffected
  • 6.18.50 to ≤ 6.18.*unaffected
  • 7.2.4 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References