title: apparmor: avoid crash when parsed profile name is empty
description: In the Linux kernel, the following vulnerability has been resolved:
apparmor: avoid crash when parsed profile name is empty
When processing a packed profile in unpack_profile() described like
"profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}"
a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then
passed to aa_splitn_fqname().
aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace.
Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later
aa_alloc_profile() crashes as the new profile name is NULL now.
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
RIP: 0010:strlen+0x1e/0xa0
Call Trace:
<TASK>
? strlen+0x1e/0xa0
aa_policy_init+0x1bb/0x230
aa_alloc_profile+0xb1/0x480
unpack_profile+0x3bc/0x4960
aa_unpack+0x309/0x15e0
aa_replace_profiles+0x213/0x33c0
policy_update+0x261/0x370
profile_replace+0x20e/0x2a0
vfs_write+0x2af/0xe00
ksys_write+0x126/0x250
do_syscall_64+0x46/0xf0
entry_SYSCALL_64_after_hwframe+0x6e/0x76
</TASK>
---[ end trace 0000000000000000 ]---
RIP: 0010:strlen+0x1e/0xa0
It seems such behaviour of aa_splitn_fqname() is expected and checked in
other places where it is called (e.g. aa_remove_profiles). Well, there
is an explicit comment "a ns name without a following profile is allowed"
inside.
AFAICS, nothing can prevent unpacked "name" to be in form like
":samba-dcerpcd" - it is passed from userspace.
Deny the whole profile set replacement in such case and inform user with
EPROTO and an explaining message.
Found by Linux Verification Center (linuxtesting.org).
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 04dc715e24d0, lessThan: 9286ee97aa48, status: affected, versionType: git
version: 04dc715e24d0, lessThan: 1d8e62b5569c, status: affected, versionType: git
version: 04dc715e24d0, lessThan: 5ff00408e502, status: affected, versionType: git
version: 04dc715e24d0, lessThan: 0a12db736edb, status: affected, versionType: git
version: 04dc715e24d0, lessThan: 9d4fa5fe2b1d, status: affected, versionType: git
version: 04dc715e24d0, lessThan: 5c0392fdafb0, status: affected, versionType: git
version: 04dc715e24d0, lessThan: 77ab09b92f16, status: affected, versionType: git
version: 04dc715e24d0, lessThan: 55a8210c9e7d, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 4.11, status: affected
version: 0, lessThan: 4.11, status: unaffected, versionType: custom
version: 4.19.306, lessThanOrEqual: 4.19.*, status: unaffected, versionType: custom
version: 5.4.268, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.209, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.148, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.75, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.14, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.2, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
