Описание
[apparmor: fix missing bounds check on DEFAULT table in verify_dfa()]
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| linux | fixed | 6.19.6-2 | package | |
| linux | fixed | 6.12.74-2 | trixie | package |
| linux | fixed | 6.1.164-1 | bookworm | package |
| linux | fixed | 5.10.251-1 | bullseye | package |
Примечания
https://git.kernel.org/linus/d352873bbefa7eb39995239d0b44ccdf8aaa79a4 (7.0-rc4)
https://www.qualys.com/2026/03/10/crack-armor.txt
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() The verify_dfa() function only checks DEFAULT_TABLE bounds when the state is not differentially encoded. When the verification loop traverses the differential encoding chain, it reads k = DEFAULT_TABLE[j] and uses k as an array index without validation. A malformed DFA with DEFAULT_TABLE[j] >= state_count, therefore, causes both out-of-bounds reads and writes. [ 57.179855] ================================================================== [ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660 [ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993 [ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy) [ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.181563] Call Trace: [ 57.181572] <TASK> [ 57.18157...