CrackAppArmor Retrospective

on YouTube ↗35m

" summary

Nine vulnerabilities producing 11 CVEs include a confused‑deputy LPE via the policy management interface CVE 202623268, a sudo-assisted escalation path, a use‑after‑free in the VFS that can wipe /etc/passwd, verifier out‑of‑bounds reads/writes that leak kernel memory, and a kernel stack overflow from unchecked policy namespace depth that enables container breakout. Fixes require multiple kernel and distro backports, Ubuntu built ~200 kernel variants, disclosure stalls on Linus tree publication and a two‑week distro embargo, and AI rapidly accelerates exploit availability.

AI-written summary · about

" chapters (11)

1. 0:00CrackAppArmor intro
2. 7:29Confused deputy in policy
3. 11:20Use-after-free in AppArmorFS
4. 14:08Missing namespace depth check
5. 15:33Verifier bugs for OOB access
6. 18:00Memory leaks in verifier
7. 19:49Disclosure with upstream kernel
8. 23:17Distro embargo challenges
9. 27:50AI reverse engineering attacks
10. 30:39Policy incompatibilities
11. 31:05Q&A

" related talks

• 44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019Tong Lin, Luhai Chen · Linux Security Summit Europe 2019
• 39mAppArmor UpdateJohn Johansen · Linux Security Summit Europe 2025
• 29mOverview and Recent Developments: AppArmorJohn Johansen · Linux Security Summit Europe 2018
• 01h 16mClassic VulnerabilitiesPatricia Aas · ACCU 2022
• 21mDevSecOops: 15 years of DevOps and patching is still horribleMichael Ducy · DevOpsDays Antwerp 2024 - 15th Anniversary edition
• 33mOverview and Recent Developments: Kernel Self-Protection ProjectKees Cook · Linux Security Summit Europe 2018
• 24mCurrent State of Exploit Mitigations in the Linux KernelLucas Amorim · BSides Vancouver 2021
• 50mPwnie Awards 2016Black Hat USA 2016