PT-2024-2006 · Linux+6 · Linux Kernel+6
Fedor Pchelkin
·
Published
2024-01-04
·
Updated
2025-09-29
·
CVE-2023-52443
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.7.0-rc2-dirty #16
Description
The vulnerability is related to the apparmor module in the Linux kernel. When processing a packed profile in unpack profile(), a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aa splitn fqname(). This function treats the string as only containing a namespace, returning NULL for tmpname while tmpns is non-NULL. Later, aa alloc profile() crashes as the new profile name is NULL, resulting in a general protection fault. The issue is caused by the fact that nothing can prevent the unpacked "name" from being in a form like ":samba-dcerpcd", which is passed from userspace. To mitigate this, the whole profile set replacement should be denied in such cases, and the user should be informed with EPROTO and an explaining message.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu