Към съдържанието
Търсене

CVE-2026-89762: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin_current_label_crit_section() AppArmor's begin_current_label_crit_section() is a scary function called from lots of LSM hooks (in particular VFS/socket-related ones) that checks if the label referenced by the current creds is marked FLAG_STALE, and if so, attempts to use aa_replace_current_label() to replace the creds with an updated version that uses a new label. The first problem with this is that it would directly lead to UAF of `struct cred` if anything in the kernel takes a pointer to the current creds and accesses these past a security hook invocation that replaces creds, like so: ``` const struct cred *cred = current_cred(); alloc_file_pseudo(...); uid_t uid = cred->euid; ``` I don't know if anything in the kernel actually does this, but I think it is very surprising that this pattern could lead to UAF. The second problem is that things go wrong when aa_replace_current_label() runs with overridden credentials. aa_replace_current_label() bails out if `current_cred() != current_real_cred()` (mirroring the check in proc_pid_attr_write()), but this check can't actually reliably detect overridden credentials because the overridden creds can be the same as the objective creds. So in approximately the following scenario, things go wrong: 1. task begins with <creds A> (as both objective and subjective creds), with refcount=2 2. task grabs an extra reference on <creds A> for overriding 3. task calls override_creds(<creds A>), which returns a pointer to the old subjective creds (<creds A>) 4. task enters AppArmor LSM hook 5. AppArmor checks that objective/subjective creds are equal 6. AppArmor replaces both cred pointers with <creds B> and drops 2 refs on <creds A> 7. task leaves AppArmor LSM hook 8. task calls revert_creds(<creds A>) 9. now task->cred is <creds A> while task->real_cred is <creds B>, but the task_struct logically holds two referen

    Засегнати продукти

    • Linux Linux: c75afcd153f6147d3b094f45a1d87e5df7f4f053 преди 42d0791f8aa90382c22dbe0443712c78d1e9d212; c75afcd153f6147d3b094f45a1d87e5df7f4f053 преди 089f10b47843a86fa03a8c20799c9353660e5288; c75afcd153f6147d3b094f45a1d87e5df7f4f053 преди 361488984d668235438faac28635f3632351407f; c75afcd153f6147d3b094f45a1d87e5df7f4f053 преди 587a6a92b93ec314c583bbf747413af170d42540; c75afcd153f6147d3b094f45a1d87e5df7f4f053 преди 580f777d6d9fd07fc034bd1aeba5c30fd48871a2; c75afcd153f6147d3b094f45a1d87e5df7f4f053 преди 3f4ae5fab613dca01d6a2a8210dd832e009fcf47
    • Linux Linux: 2.6.36; преди 2.6.36; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.109 до 6.12.*; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; от 7.3 нататък

    История

    • 11 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-89762: Linux | freedomonline.bg