github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

apparmor: check accept index + 1 is in bounds

Browse Source 
aa_lookup_condperms() returns perms[index + 1] when an accept entry has
ACCEPT_FLAG_OWNER set and the subject uid does not match the file uid,
so such an entry consumes two slots in the perms table.  But
verify_dfa_accept_index() only checks that index is within the perms
table, so a policy that sets the owner flag on the last entry is
accepted, and the runtime lookup then reads perms[index + 1] one entry
past the end of the table.

The perms table is allocated by unpack_perms_table() with a u16 size
read from the policy blob, so a crafted policy can place the owner flag
at index size - 1 to reach the out-of-bounds read.

Check that index + 1 is also in bounds when the owner flag is set.

Fixes: 6f442d42c0 ("apparmor: fix profile verification and enable it")
Cc: stable@vger.kernel.org
Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Guanglei Zhu 2026-09-16 19:53:07 +08:00 committed by John Johansen
parent fcd621debf
commit afe5d5a747
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
security/apparmor/policy_unpack.c
View File

@ -1495,6 +1495,15 @@ static bool verify_dfa_accept_index(const struct aa_dfa *dfa, int table_size)
for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
if (ACCEPT_TABLE(dfa)[i] >= table_size)
return false;
/*
* Accept indexes for owner-conditional permissions come in
* pairs, so the non-owner entry at index + 1 must also be
* in bounds.
*/
if (dfa->tables[YYTD_ID_ACCEPT2] &&
(ACCEPT_TABLE2(dfa)[i] & ACCEPT_FLAG_OWNER) &&
ACCEPT_TABLE(dfa)[i] + 1 >= table_size)
return false;
}
return true;
}