Thus, “there may be little impression of not ‘patching’ the vulnerability,” he mentioned. “Organizations utilizing centralized configuration instruments like Ansible could deploy these adjustments with repeatedly scheduled upkeep or reboot home windows.”
Options supposed to enhance safety
Satirically, final October Ubuntu launched AppArmor-based options to enhance safety by decreasing the assault floor from unprivileged person namespaces within the Linux kernel. It didn’t fairly do this.
“That is an unintended consequence the place a safety management was put in place but it surely isn’t absolutely utilized,” mentioned Beggs, “so it permits anybody to push and escalate their privileges.”
Three bypasses
Unprivileged person namespaces are a function within the Linux kernel which can be supposed to supply further sandboxing performance for packages equivalent to container runtimes, says Ubuntu. It permits unprivileged customers to achieve administrator (root) permissions inside a confined setting, with out giving them elevated permissions on the host system.
Nonetheless, unprivileged person namespaces have been repeatedly used to take advantage of kernel vulnerabilities, so the AppArmor restriction added to Ubuntu 23.10 and 24.04 LTS was alleged to act as a safety hardening measure.
However Qualys discovered three different bypasses, every of which permits an area attacker to create person namespaces with full administrator capabilities, and subsequently to nonetheless exploit vulnerabilities in kernel parts that require capabilities equivalent to CAP_SYS_ADMIN or CAP_NET_ADMIN:
