● CVE-2024-26642 / Policy Bypass

CVE-2024-26642: AppArmor Socket Mediation Security Policy Bypass Teardown

How an unvetted socket creation flags validation bug in security/apparmor/net.c allowed sandboxed snap processes to create arbitrary raw network sockets.

💡 通俗通俗化解析 (ELI5)

Imagine a prison guard who checks everyone entering the gate. He has a list that says 'Visitors can only bring paper, not knives or keys'. But a sneaky visitor passes a key hidden inside a box with a special label 'Special Fragile'. The guard only checks standard boxes, ignores the special label, and lets the prisoner receive a master key.

核心概念与底层架构术语

AppArmor: A Linux Security Module (LSM) that confines programs to a limited set of files, capabilities, and network resources based on profiles.
Raw Sockets (SOCK_RAW): Network sockets that allow applications direct access to lower-level networking protocols, capable of IP spoofing and packet sniffing.
Security Profile Mediation: The kernel hook intercepting syscalls to check whether the process's assigned AppArmor profile permits the action.
Snap Confinement: Ubuntu's sandboxing mechanism that relies on AppArmor to isolate desktop and server applications.

攻击利用全流程逐步拆解

Step 1

1. Sandboxed App Execution

A confined application runs under a restrictive AppArmor profile forbidding raw network sockets.

Step 2

2. Invoking Socket with Special Flags

The process calls socket(AF_INET, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, IPPROTO_RAW).

Step 3

3. Bitmask Validation Oversight

AppArmor's check compared raw integer values instead of masking out ancillary flags, skipping the denial.

Step 4

4. Network Policy Evasion

The restricted app sends spoofed raw packets and sniffs local traffic across the host.

源码对比：致命缺陷 vs. 加固补丁

采用清晰易读的高级编程语言展示（不含晦涩汇编或二进制机器码）。

未修补缺陷代码

// VULNERABLE: security/apparmor/net.c before patch
int aa_profile_af_perm(struct aa_profile *profile, int family, int type, int protocol) {
    // ROOT CAUSE:
    // 'type' contains socket creation flags (e.g., SOCK_CLOEXEC, SOCK_NONBLOCK)!
    // Direct lookup fails because the policy table only defines base types (SOCK_RAW = 3)!
    // If type = (SOCK_RAW | SOCK_CLOEXEC) = 0x80003, rule lookup miss defaults to ALLOW!
    return aa_lookup_net(profile, family, type, protocol);
}

安全加固补丁

// SECURE: security/apparmor/net.c patch
int aa_profile_af_perm(struct aa_profile *profile, int family, int type, int protocol) {
    // 1. Mask out socket creation flags to extract purely the fundamental socket type
    int base_type = type & SOCK_TYPE_MASK;
    
    // 2. Perform policy mediation lookup using sanitized base type
    return aa_lookup_net(profile, family, base_type, protocol);
}

工程落地与系统加固清单

Always mask out auxiliary flags (e.g. `SOCK_CLOEXEC`, `SOCK_NONBLOCK`) before performing security policy checks.
Default to DENY upon rule lookup misses in mandatory access control frameworks.
Write comprehensive negative test cases verifying that flag combinations do not evade security mediation.
Regularly audit LSM hook implementations with kernel fuzzing tools like syzkaller.

← 浏览完整安全目录所有平台安全更新 →