● CVE-2024-26642 / Policy Bypass

CVE-2024-26642: AppArmor Socket Mediation Security Policy Bypass Teardown

How an unvetted socket creation flags validation bug in security/apparmor/net.c allowed sandboxed snap processes to create arbitrary raw network sockets.

💡 Explication en Termes Simples (ELI5)

Imagine a prison guard who checks everyone entering the gate. He has a list that says 'Visitors can only bring paper, not knives or keys'. But a sneaky visitor passes a key hidden inside a box with a special label 'Special Fragile'. The guard only checks standard boxes, ignores the special label, and lets the prisoner receive a master key.

Concepts Clés et Termes du Sous-système

AppArmor: A Linux Security Module (LSM) that confines programs to a limited set of files, capabilities, and network resources based on profiles.
Raw Sockets (SOCK_RAW): Network sockets that allow applications direct access to lower-level networking protocols, capable of IP spoofing and packet sniffing.
Security Profile Mediation: The kernel hook intercepting syscalls to check whether the process's assigned AppArmor profile permits the action.
Snap Confinement: Ubuntu's sandboxing mechanism that relies on AppArmor to isolate desktop and server applications.

Mécanique d'Exécution Étape par Étape

Step 1

1. Sandboxed App Execution

A confined application runs under a restrictive AppArmor profile forbidding raw network sockets.

Step 2

2. Invoking Socket with Special Flags

The process calls socket(AF_INET, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, IPPROTO_RAW).

Step 3

3. Bitmask Validation Oversight

AppArmor's check compared raw integer values instead of masking out ancillary flags, skipping the denial.

Step 4

4. Network Policy Evasion

The restricted app sends spoofed raw packets and sniffs local traffic across the host.

Code Source : Faille Critique vs. Correctif Sécurisé

Fourni en code source de haut niveau lisible (sans assembleur brut ni diff binaire).

FAILLE NON CORRIGÉE

// VULNERABLE: security/apparmor/net.c before patch
int aa_profile_af_perm(struct aa_profile *profile, int family, int type, int protocol) {
    // ROOT CAUSE:
    // 'type' contains socket creation flags (e.g., SOCK_CLOEXEC, SOCK_NONBLOCK)!
    // Direct lookup fails because the policy table only defines base types (SOCK_RAW = 3)!
    // If type = (SOCK_RAW | SOCK_CLOEXEC) = 0x80003, rule lookup miss defaults to ALLOW!
    return aa_lookup_net(profile, family, type, protocol);
}

CORRECTIF RENFORCÉ

// SECURE: security/apparmor/net.c patch
int aa_profile_af_perm(struct aa_profile *profile, int family, int type, int protocol) {
    // 1. Mask out socket creation flags to extract purely the fundamental socket type
    int base_type = type & SOCK_TYPE_MASK;
    
    // 2. Perform policy mediation lookup using sanitized base type
    return aa_lookup_net(profile, family, base_type, protocol);
}

Checklist d'Ingénierie et de Durcissement Système

Always mask out auxiliary flags (e.g. `SOCK_CLOEXEC`, `SOCK_NONBLOCK`) before performing security policy checks.
Default to DENY upon rule lookup misses in mandatory access control frameworks.
Write comprehensive negative test cases verifying that flag combinations do not evade security mediation.
Regularly audit LSM hook implementations with kernel fuzzing tools like syzkaller.

← Parcourir l'Annuaire de Sécurité Tous les Bulletins de Sécurité →