control: affects -1 netcat-openbsd
Hi,
On 2026-10-20 23:39, Adrian Bunk wrote:
> On Sun, Oct 18, 2026 at 09:34:39AM +0200, Paul Gevers wrote:
> > Hi,
>
> Hi Paul,
>
> > I find it a bit difficult to track if either of the patches landed already
> > in the kernel used by the buildds.
>
> the issue is still seen on the buildds, I think netcat-openbsd today
> killed buildds on loong64 and in ports on pppc64 and sparc64.
The issue is still present upstream, and thus in the testing, unstable,
experimental and backports kernels. Two similar patches fixing the issue
have been posted so far. If the fix is not pushed through the next merge
window, I think the kernel team should either:
- bypass the policy that the patches need to be merged upstream first
- or disable apparmor in the debian kernel
Please also find below a simpler reproducer, it just needs python to
crash a default forky installation. What is nice is that it works for
all architectures without having to special case them.
Regards
Aurelien
#!/usr/bin/env python3
import os, socket, sys
if '--payload' in sys.argv:
server = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
server.setsockopt(socket.SOL_SOCKET, socket.SO_PASSCRED, 1)
server.bind('\0aa-crash-server')
client = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
client.connect('\0aa-crash-server')
os.writev(client.fileno(), [b'\0' * 16])
sys.exit()
# Run the payload using the unprivileged_userns AA profile
os.execvp('aa-exec', ['aa-exec', '-p', 'unprivileged_userns', '--',
sys.executable, os.path.abspath(__file__), '--payload'])
--
Aurelien Jarno GPG: 4096R/1DDD8C9B
[email protected] http://aurel32.net
