PT-2017-17120 · Canonical+1 · Apparmor+2

Stéphane Graber + 1 · Published 2017-03-24 · Updated 2019-10-03 · CVE-2017-6507

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions AppArmor versions prior to 2.12

Description An issue in AppArmor allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files. The common logic to handle 'restart' operations removes AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories are affected by this flaw.

Recommendations For versions prior to 2.12, update to version 2.12 or later to resolve the issue. As a temporary workaround, consider modifying the AppArmor init script logic to correctly handle unknown AppArmor profiles in atypical directories. Restrict access to the affected processes to minimize the risk of exploitation until the issue is resolved.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2017-6507

OPENSUSE-SU-2017_0969-1

OPENSUSE-SU-2024:10627-1

SUSE-SU-2017:1151-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

SUSE-SU-2017_1151-1

USN-3247-1

Affected Products

Apparmor

Suse

Ubuntu

References · 22

• https://osv.dev/vulnerability/CVE-2017-6507 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6507 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6507 · Security Note
• https://bugs.launchpad.net/apparmor/+bug/1668892 · Patch
• https://osv.dev/vulnerability/USN-3247-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3247-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-6507 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6507 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1151-1 · Vendor Advisory
• http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3648 · Patch
• http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3647 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-6507 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-6507 · Vendor Advisory
• https://bugzilla.suse.com/1029696 · Note
• https://suse.com/support/update/announcement/2017/suse-su-20171151-1 · Note