● CVE-2024-26642 / Policy Bypass

CVE-2024-26642: AppArmor Socket Mediation Security Policy Bypass Teardown

How an unvetted socket creation flags validation bug in security/apparmor/net.c allowed sandboxed snap processes to create arbitrary raw network sockets.

💡 Простое объяснение на пальцах (ELI5)

Imagine a prison guard who checks everyone entering the gate. He has a list that says 'Visitors can only bring paper, not knives or keys'. But a sneaky visitor passes a key hidden inside a box with a special label 'Special Fragile'. The guard only checks standard boxes, ignores the special label, and lets the prisoner receive a master key.

Ключевые концепции и архитектурные термины

AppArmor: A Linux Security Module (LSM) that confines programs to a limited set of files, capabilities, and network resources based on profiles.
Raw Sockets (SOCK_RAW): Network sockets that allow applications direct access to lower-level networking protocols, capable of IP spoofing and packet sniffing.
Security Profile Mediation: The kernel hook intercepting syscalls to check whether the process's assigned AppArmor profile permits the action.
Snap Confinement: Ubuntu's sandboxing mechanism that relies on AppArmor to isolate desktop and server applications.

Пошаговая механика выполнения атаки

Step 1

1. Sandboxed App Execution

A confined application runs under a restrictive AppArmor profile forbidding raw network sockets.

Step 2

2. Invoking Socket with Special Flags

The process calls socket(AF_INET, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, IPPROTO_RAW).

Step 3

3. Bitmask Validation Oversight

AppArmor's check compared raw integer values instead of masking out ancillary flags, skipping the denial.

Step 4

4. Network Policy Evasion

The restricted app sends spoofed raw packets and sniffs local traffic across the host.

Исходный код: Уязвимость vs. Исправленный патч

Представлено на понятном высокоуровневом исходном коде (без ассемблера и бинарных дампов).

УЯЗВИМЫЙ КОД ДО ПАТЧА

// VULNERABLE: security/apparmor/net.c before patch
int aa_profile_af_perm(struct aa_profile *profile, int family, int type, int protocol) {
    // ROOT CAUSE:
    // 'type' contains socket creation flags (e.g., SOCK_CLOEXEC, SOCK_NONBLOCK)!
    // Direct lookup fails because the policy table only defines base types (SOCK_RAW = 3)!
    // If type = (SOCK_RAW | SOCK_CLOEXEC) = 0x80003, rule lookup miss defaults to ALLOW!
    return aa_lookup_net(profile, family, type, protocol);
}

БЕЗОПАСНОЕ ИСПРАВЛЕНИЕ

// SECURE: security/apparmor/net.c patch
int aa_profile_af_perm(struct aa_profile *profile, int family, int type, int protocol) {
    // 1. Mask out socket creation flags to extract purely the fundamental socket type
    int base_type = type & SOCK_TYPE_MASK;
    
    // 2. Perform policy mediation lookup using sanitized base type
    return aa_lookup_net(profile, family, base_type, protocol);
}

Инженерный чек-лист для код-ревью и защиты систем

Always mask out auxiliary flags (e.g. `SOCK_CLOEXEC`, `SOCK_NONBLOCK`) before performing security policy checks.
Default to DENY upon rule lookup misses in mandatory access control frameworks.
Write comprehensive negative test cases verifying that flag combinations do not evade security mediation.
Regularly audit LSM hook implementations with kernel fuzzing tools like syzkaller.

← Полный каталог уязвимостей Все бюллетени безопасности →