Thus, “there may be little influence of not ‘patching’ the vulnerability,” he mentioned. “Organizations utilizing centralized configuration instruments like Ansible could deploy these adjustments with repeatedly scheduled upkeep or reboot home windows.”
Options supposed to enhance safety
Satirically, final October Ubuntu launched AppArmor-based options to enhance safety by lowering the assault floor from unprivileged person namespaces within the Linux kernel. It didn’t fairly do this.
“That is an unintended consequence the place a safety management was put in place nevertheless it isn’t absolutely utilized,” mentioned Beggs, “so it permits anybody to push and escalate their privileges.”
Three bypasses
Unprivileged person namespaces are a characteristic within the Linux kernel which might be supposed to supply extra sandboxing performance for applications similar to container runtimes, says Ubuntu. It permits unprivileged customers to realize administrator (root) permissions inside a confined atmosphere, with out giving them elevated permissions on the host system.
Nonetheless, unprivileged person namespaces have been repeatedly used to use kernel vulnerabilities, so the AppArmor restriction added to Ubuntu 23.10 and 24.04 LTS was presupposed to act as a safety hardening measure.
However Qualys discovered three different bypasses, every of which permits an area attacker to create person namespaces with full administrator capabilities, and subsequently to nonetheless exploit vulnerabilities in kernel elements that require capabilities similar to CAP_SYS_ADMIN or CAP_NET_ADMIN:
