Public bug reported:
## Affects
- linux (Ubuntu) — Noble 6.8
## Description
security/apparmor/apparmorfs.c:769 — APPARMOR_NOTIF_SET_FILTER assigns
new DFA to listener->filter without calling aa_put_dfa() on the old
filter first. Repeated SET_FILTER calls leak DFA objects.
Also adds a duplicate proxy registration on each call.
## Who can trigger
CAP_MAC_ADMIN.
## Impact
Memory leak. Repeated calls exhaust kernel memory. Not LPE.
Low severity.
## Suggested fix
Call aa_put_dfa(listener->filter) before assigning new filter.
## Discovery method
LLM-assisted code review of Ubuntu SAUCE AppArmor 4.0
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2173153
Title:
[Ubuntu Noble 6.8] AppArmor notification: DFA filter memory leak on
repeated APPARMOR_NOTIF_SET_FILTER
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173153/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
