mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 22:07:35 -04:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: fix potential UAF in aa_replace_profiles

Browse Source 
The function aa_replace_profiles was accessing udata->size after calling
aa_put_loaddata(udata), causing a potential UAF.

Fixed this by saving the size to a local variable before dropping the
reference.

Fixes: 5ac8c355ae ("apparmor: allow introspecting the loaded policy pre internal transform")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Maxime Bélair
2026-02-18 10:27:34 +01:00
committed by John Johansen
parent b9b864fc72
commit 7b42f95813
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
security/apparmor/policy.c
View File

@@ -1378,13 +1378,15 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
mutex_unlock(&ns->lock);
out:
ssize_t udata_sz = udata->size;
aa_put_ns(ns);
aa_put_profile_loaddata(udata);
kfree(ns_name);
if (error)
return error;
return udata->size;
return udata_sz;
fail_lock:
mutex_unlock(&ns->lock);