An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic.
CVSS Details
- CVSS 3.0 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade apparmor | Jul 30, 2024 | Mar 24, 2017 |
| Suse | — | Upgrade apparmor-profilesUpgrade apparmor-parserUpgrade sles12-docker-imageUpgrade apache2-mod_apparmorUpgrade libapparmor1-32bitUpgrade pam_apparmor-32bitUpgrade sles12sp2-docker-imageUpgrade apparmor-abstractionsUpgrade apparmor-docsUpgrade apparmor-parser-langUpgrade python3-apparmorUpgrade apparmor-utilsUpgrade perl-apparmorUpgrade pam_apparmorUpgrade apparmor-utils-langUpgrade libapparmor1Upgrade sles12sp1-docker-imageUpgrade libapparmor-devel | Apr 10, 2017 | Mar 24, 2017 |
| Ubuntu | — | Upgrade apparmor | Mar 29, 2017 | Mar 24, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub