[PATCH OLK-5.10 0/2] Fix CVE-2026-80619
The following patches are used to fix the CVE-2026-80619 vulnerability: John Johansen (1): apparmor: fix label can not be immediately before a declaration Maxime Bélair (1): apparmor: fix potential UAF in aa_replace_profiles security/apparmor/policy.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.25.1
From: Maxime Bélair <maxime.belair@canonical.com> stable inclusion from stable-v5.10.261 commit 9d8e47cbce7536f19c96e37d0685a042010187ee category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18554 CVE: CVE-2026-80619 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 7b42f95813dc9ceb6bda35afcf914630909a19f9 ] The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF. Fixed this by saving the size to a local variable before dropping the reference. Fixes: 5ac8c355ae001 ("apparmor: allow introspecting the loaded policy pre internal transform") Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com> Signed-off-by: Maxime Bélair <maxime.belair@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Yi Yang <yiyang13@huawei.com> --- security/apparmor/policy.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index dca1c26c456d..c0ed24dc25f4 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -920,6 +920,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label, struct aa_loaddata *rawdata_ent; const char *op; ssize_t count, error; + ssize_t udata_sz; LIST_HEAD(lh); op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD; @@ -1104,13 +1105,15 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label, mutex_unlock(&ns->lock); out: + udata_sz = udata->size; + aa_put_ns(ns); aa_put_profile_loaddata(udata); kfree(ns_name); if (error) return error; - return udata->size; + return udata_sz; fail_lock: mutex_unlock(&ns->lock); -- 2.25.1
From: John Johansen <john.johansen@canonical.com> stable inclusion from stable-v5.10.261 commit 254ceb4fb09f2916159081e74f3d6c42ffe376b7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18554 CVE: CVE-2026-80619 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 1ed40bd525c00d22af666016af9aef7167f8085f ] Fix error reported by kernel test robot security/apparmor/policy.c:1381:2: error: a label can only be part of a statement and a declaration is not a statement All errors (new ones prefixed by >>): security/apparmor/policy.c: In function 'aa_replace_profiles':
security/apparmor/policy.c:1381:2: error: a label can only be part of a statement and a declaration is not a statement ssize_t udata_sz = udata->size; ^~~~~
Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202606150525.npax8WiH-lkp@intel.com/ Fixes: 7b42f95813dc9 ("apparmor: fix potential UAF in aa_replace_profiles") Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Yi Yang <yiyang13@huawei.com> --- security/apparmor/policy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index c0ed24dc25f4..b90b8c9cf6f7 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -1105,9 +1105,10 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label, mutex_unlock(&ns->lock); out: + aa_put_ns(ns); + udata_sz = udata->size; - aa_put_ns(ns); aa_put_profile_loaddata(udata); kfree(ns_name); -- 2.25.1
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://atomgit.com/openeuler/kernel/merge_requests/27168 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/QSB... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://atomgit.com/openeuler/kernel/merge_requests/27168 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/QSB...
participants (2)
-
patchwork bot -
Yi Yang