CrackArmor — 9 Linux AppArmor Confused Deputy Vulnerabilities Enable Root Privilege Escalation and Container Escape — Threadlinqs Intelligence
As of 2026-05-30, CrackArmor — 9 Linux AppArmor Confused Deputy Vulnerabilities Enable Root Privilege Escalation and Container Escape is a high-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-0228 · Severity: HIGH · CVSS: 8.4 · Status: PATCHED · Category: VULNERABILITY
Attribution: N/A · UNKNOWN
Qualys Threat Research Unit discovered 9 confused deputy vulnerabilities in the Linux kernel AppArmor LSM module (kernel 4.11+ since 2017) affecting 12.6 million enterprise systems. Unprivileged local
CrackArmor is a collection of nine vulnerabilities discovered by the Qualys Threat Research Unit (TRU) in the Linux kernel's AppArmor Linux Security Module (LSM). AppArmor is a mandatory access control (MAC) framework that confines programs to a limited set of resources, and is enabled by default on Ubuntu, Debian, and SUSE distributions. The vulnerabilities have existed since Linux kernel version 4.11 (2017), impacting an estimated 12.6 million enterprise Linux systems worldwide.
The core vulnerability class is "confused deputy" — AppArmor's securityfs pseudo-files (.load, .replace, .remove) under /sys/kernel/security/apparmor/ are created with world-writable permissions (mode 0666), allowing any unprivileged user to open them for writing. While direct writes fail with EACCES, attackers can use the dup2() syscall to redirect a privileged program's output (such as su in PTY mode) through these file descriptors, effectively loading, replacing, or removing arbitrary AppArmor profiles with full kernel privileges.
Vulnerability 1 (Confused Deputy, CWE-269): The fundamental flaw enabling all subsequent attacks. Unprivileged users open securityfs pseudo-files in O_WRONLY mode, then use dup2() to redirect privileged program stderr to these descriptors. The su command with -P (PTY) flag writes controlled binary data including null bytes, enabling arbitrary profile manipulation. This allows attackers to remove protective profiles from system services (rsyslogd, cupsd), load restrictive deny-all profiles causing denial of service, and bypass Ubuntu's unprivileged user-namespace restrictions.
Vulnerability 2 (Uncontrolled Recursion, CWE-674): The __remove_profile() function recursively calls itself via __aa_profile_list_release() without depth limits when processing nested subprofiles. An attacker can create deeply nested profile hierarchies (1024 levels: "a//x//x//x...") and trigger removal, exhausting the 16KB kernel stack on x86_64 systems. CONFIG_VMAP_STACK guard pages prevent arbitrary code execution, limiting impact to complete system crash (denial of service).
Vulnerability 3 (Out-of-Bounds Read, CWE-125): The match_char() macro evaluates arguments multiple times, causing the string pointer to increment multiple times due to MATCH_FLAG_DIFF_ENCODE logic. By crafting DFA matching patterns with wildcards followed by specific ranges, attackers can read up to 64KB past the allocated 8KB kmalloc buffer, disclosing KASLR-randomized kernel pointers including aa_global_buffers, shmem_ops, and noop_backing_dev_info addresses.
Vulnerability 4 (Use-After-Free, CWE-416): aa_loaddata structures in the kmalloc-192 slab cache are referenced by securityfs dentries without proper refcounting. A race condition exists between path_openat() acquiring a dentry reference and do_dentry_open() calling seq_rawdata_open(), while concurrent profile removal triggers kfree_sensitive() via delayed work. The race window can be widened to seconds by loading profiles with massive DFAs (~64K states). Exploitation on Ubuntu 24.04.3 involves cross-cache attacks, page table takeover via Jann Horn's technique (CVE-2020-29661), mapping /etc/passwd pages through re-allocated page tables, and writing a passwordless root entry. This is the most severe vulnerability, enabling reliable local privilege escalation to root.
Vulnerability 5 (Double-Free, CWE-415): In aa_replace_profiles(), the namespace name pointer ns_name is freed twice — first via aa_load_ent_free() at line 1262, then again via kfree(ns_name) at line 1270. The race window can be expanded to several seconds by writing 1024+ profiles with 16 subprofiles each. Exploitation on Debian 13.1 uses AF_PACKET page vectors and signalfd(-1) calls to achieve arbitrary credential modification, zeroing uid for root access. CONFIG_SLAB_BUCKETS is bypassed using user-key and AF_PACKET buffers.
Vulnerabilities 6-9 include a memory leak in verify_header(), missing namespace depth limits, out-of-bounds read/write in the
Weaknesses (CWE)
CWE-269, CWE-674, CWE-125, CWE-416, CWE-415
Target sectors: government, financial, healthcare, technology, telecommunications, energy, defense, cloud-services, education
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1059, T1068, T1611, T1548, T1562, T1548, T1014, T1222, T1003, T1082