● CVE-2024-26642 / Policy Bypass

CVE-2024-26642: AppArmor Socket Mediation Security Policy Bypass Teardown

How an unvetted socket creation flags validation bug in security/apparmor/net.c allowed sandboxed snap processes to create arbitrary raw network sockets.

💡 Penjelasan Bahasa Sederhana (ELI5)

Imagine a prison guard who checks everyone entering the gate. He has a list that says 'Visitors can only bring paper, not knives or keys'. But a sneaky visitor passes a key hidden inside a box with a special label 'Special Fragile'. The guard only checks standard boxes, ignores the special label, and lets the prisoner receive a master key.

Konsep Inti dan Istilah Subsistem

AppArmor: A Linux Security Module (LSM) that confines programs to a limited set of files, capabilities, and network resources based on profiles.
Raw Sockets (SOCK_RAW): Network sockets that allow applications direct access to lower-level networking protocols, capable of IP spoofing and packet sniffing.
Security Profile Mediation: The kernel hook intercepting syscalls to check whether the process's assigned AppArmor profile permits the action.
Snap Confinement: Ubuntu's sandboxing mechanism that relies on AppArmor to isolate desktop and server applications.

Mekanisme Serangan Langkah demi Langkah

Step 1

1. Sandboxed App Execution

A confined application runs under a restrictive AppArmor profile forbidding raw network sockets.

Step 2

2. Invoking Socket with Special Flags

The process calls socket(AF_INET, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, IPPROTO_RAW).

Step 3

3. Bitmask Validation Oversight

AppArmor's check compared raw integer values instead of masking out ancillary flags, skipping the denial.

Step 4

4. Network Policy Evasion

The restricted app sends spoofed raw packets and sniffs local traffic across the host.

Kode Sumber: Celah Fatal vs. Perbaikan Aman

Disajikan dalam bahasa pemrograman tingkat tinggi yang mudah dibaca (tanpa assembly rumit).

CELAH BELUM DITAMBAL

// VULNERABLE: security/apparmor/net.c before patch
int aa_profile_af_perm(struct aa_profile *profile, int family, int type, int protocol) {
    // ROOT CAUSE:
    // 'type' contains socket creation flags (e.g., SOCK_CLOEXEC, SOCK_NONBLOCK)!
    // Direct lookup fails because the policy table only defines base types (SOCK_RAW = 3)!
    // If type = (SOCK_RAW | SOCK_CLOEXEC) = 0x80003, rule lookup miss defaults to ALLOW!
    return aa_lookup_net(profile, family, type, protocol);
}

PATCH YANG DIPERKUAT

// SECURE: security/apparmor/net.c patch
int aa_profile_af_perm(struct aa_profile *profile, int family, int type, int protocol) {
    // 1. Mask out socket creation flags to extract purely the fundamental socket type
    int base_type = type & SOCK_TYPE_MASK;
    
    // 2. Perform policy mediation lookup using sanitized base type
    return aa_lookup_net(profile, family, base_type, protocol);
}

Daftar Periksa Rekayasa & Pengerasan Sistem

Always mask out auxiliary flags (e.g. `SOCK_CLOEXEC`, `SOCK_NONBLOCK`) before performing security policy checks.
Default to DENY upon rule lookup misses in mandatory access control frameworks.
Write comprehensive negative test cases verifying that flag combinations do not evade security mediation.
Regularly audit LSM hook implementations with kernel fuzzing tools like syzkaller.

← Jelajahi Direktori Keamanan Lengkap Semua Pembaruan Keamanan →