Re: [PATCH 6.6.y] apparmor: fix cred UAF caused by begin_current_label_crit_section()

[sashiko-bot@kernel.org]

> From: Jann Horn <jannh@google.com>
> 
> [ Upstream commit 3f4ae5fab613dca01d6a2a8210dd832e009fcf47 ]
> 
> AppArmor's begin_current_label_crit_section() is a scary function called
> from lots of LSM hooks (in particular VFS/socket-related ones) that checks
> if the label referenced by the current creds is marked FLAG_STALE, and if
> so, attempts to use aa_replace_current_label() to replace the creds with an
> updated version that uses a new label.
> 
> The first problem with this is that it would directly lead to UAF of
> `struct cred` if anything in the kernel takes a pointer to the current
> creds and accesses these past a security hook invocation that replaces
> creds, like so:
> ```
> [ ... ]
> Fixes: c75afcd153f6 ("AppArmor: contexts used in attaching policy to system objects")
> Signed-off-by: Jann Horn <jannh@google.com>
> Signed-off-by: John Johansen <john.johansen@canonical.com>
> Assisted-by: LLM
> Signed-off-by: Artem Dinaburg <artem@trailofbits.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014193517.24940-1-artem@trailofbits.com?part=1