Public bug reported:
## Affects
- linux (Ubuntu) — Noble 6.8
## Description
security/apparmor/capability.c:205,212 — two bugs in
aa_profile_capget():
1. Loop bound `i < (CAP_LAST_CAP >> 5)` should be `<=`.
CAP_LAST_CAP=40, 40>>5=1, loop runs only for i=0 (caps 0-31).
Caps 32-40 (CAP_MAC_ADMIN, CAP_SYSLOG, CAP_PERFMON, CAP_BPF,
CAP_CHECKPOINT_RESTORE) are skipped.
2. Shift `i * 5` should be `i * 32`. Currently masked because
loop only runs once (i=0), but would produce garbage if loop
bound is fixed without fixing shift.
## Impact
capget() misreports caps 32-40 as not-permitted for AppArmor-
confined processes. Enforcement (profile_capable) is unaffected —
reporting inconsistency only. Could confuse capsh/getpcaps.
Low severity.
## Suggested fix
```diff
-for (i = 0; i < (CAP_LAST_CAP >> 5); i++) {
+for (i = 0; i <= (CAP_LAST_CAP >> 5); i++) {
...
- caps.val |= ((u64)(perms.allow)) << (i * 5);
+ caps.val |= ((u64)(perms.allow)) << (i * 32);
```
## Discovery method
LLM-assisted code review of Ubuntu SAUCE AppArmor 4.0
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2173155
Title:
[Ubuntu Noble 6.8] AppArmor capget: off-by-one loop bound + wrong bit
shift skips caps 32-40
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173155/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
