github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

apparmor: fix potential UAF in aa_replace_profiles

Browse Source 
The function aa_replace_profiles was accessing udata->size after calling
aa_put_loaddata(udata), causing a potential UAF.

Fixed this by saving the size to a local variable before dropping the
reference.

Fixes: 5ac8c355ae ("apparmor: allow introspecting the loaded policy pre internal transform")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Maxime Bélair 2026-02-18 10:27:34 +01:00 committed by John Johansen
parent b9b864fc72
commit 7b42f95813
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
security/apparmor/policy.c
View File

@ -1378,13 +1378,15 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
mutex_unlock(&ns->lock); mutex_unlock(&ns->lock);
out: out:
ssize_t udata_sz = udata->size;
aa_put_ns(ns); aa_put_ns(ns);
aa_put_profile_loaddata(udata); aa_put_profile_loaddata(udata);
kfree(ns_name); kfree(ns_name);
if (error) if (error)
return error; return error;
return udata->size; return udata_sz;
fail_lock: fail_lock:
mutex_unlock(&ns->lock); mutex_unlock(&ns->lock);