CrackArmor vulnerabilities in AppArmor: Ubuntu, Debian and Suse affected by critical vulnerabilities

The vulnerabilities have existed since 2017 and affect an estimated 12.6 million systems worldwide, so an immediate kernel patch installation is essential to neutralize these threats.

Everything you need to know about CrackArmor

• Discovery of vulnerabilities: The Qualys TRU identified nine “Confused Deputy” vulnerabilities in AppArmor, a standard Mandatory Access Control (MAC) mechanism for several Linux distributions, including Ubuntu, Debian and SUSE.
• Extensive reach: Over 12.6 million enterprise Linux instances are affected as AppArmor is widely deployed in various environments, from cloud platforms to IoT devices.
• Security Impact: The vulnerabilities allow unprivileged users to manipulate security profiles via pseudo-files, bypass user namespace restrictions and execute arbitrary code in the kernel, resulting in significant breaches of system confidentiality, integrity and availability.
• Immediate action required: Organizations must prioritize the immediate patching of their kernels to address these critical vulnerabilities, as interim solutions do not provide sufficient security guarantees.

Detailed analysis

The CrackArmor report reveals a fundamental flaw in the standard security assumptions that many organizations rely on. Exploitation of these vulnerabilities allows unprivileged users to gain root access and subvert container isolation, fundamentally undermining the basic trust boundaries for millions of endpoints in the enterprise infrastructure simultaneously.

Technical Overview

• Confused Deputy Flaw: An unprivileged user can manipulate a privileged process to perform actions on their behalf, effectively tricking trusted tools like Sudo and Postfix into bypassing security controls they cannot directly access.
• Impact on Enterprise Linux environments: The vulnerabilities allow local privilege escalation (LPE) up to root privileges through complex interactions with existing tools, as well as denial of service attacks via stack exhaustion and Kernel Address Space Layout Randomization (KASLR) bypasses.
• Broad spectrum of affected systems: All Linux kernels from version 4.11 are vulnerable in distributions that integrate AppArmor, including Ubuntu, Debian, SUSE and their derivatives.

CrackArmor countermeasures

Patching

Apply vendor security updates for AppArmor components in all affected distributions to restore the corrected code path.

Check for security vulnerabilities

Use Qualys QIDs to identify internally exposed resources with risky open ports or unpatched kernels.

Profile monitoring

Implement monitoring under /sys/kernel/security/apparmor/ for unexpected changes that could indicate active exploitation attempts.

Possible effects

The CrackArmor vulnerabilities pose significant risks to enterprise environments, including the possibility of unprivileged local actors manipulating AppArmor profiles to disable protection of critical services or enforce “deny-all” policies, leading to denial of service (DoS) attacks and local privilege escalation (LPE).

Timing and disclosure

Qualys has adhered to a responsible disclosure process and ensured that robust and stable fixes are available for all Linux distributions prior to public release. The full communication protocol is included in the advisory to ensure transparency regarding coordination efforts.

Organizations must scan all Linux endpoints with the provided QIDs, prioritize the installation of patches for internet-facing resources, and verify the integrity of AppArmor profiles to prevent security compromise.