# CrackArmor — 9 Linux AppArmor Confused Deputy Vulnerabilities Enable Root Privilege Escalation and Container Escape

> Qualys Threat Research Unit discovered 9 confused deputy vulnerabilities in the Linux kernel AppArmor LSM module (kernel 4.11+ since 2017) affecting 12.6 million enterprise systems. Unprivileged local attackers can manipulate AppArmor security profiles via securityfs pseudo-files to achieve root privilege escalation, bypass container isolation, defeat KASLR, and cause denial of service via kernel stack exhaustion.

- **Published:** 2026-03-14T12:00:00Z
- **Last reviewed:** 2026-03-14T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0228
- **ID:** TL-2026-0228
- **Severity:** HIGH (CVSS 8.4)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CrackArmor is a collection of nine vulnerabilities discovered by the Qualys Threat Research Unit (TRU) in the Linux kernel's AppArmor Linux Security Module (LSM). AppArmor is a mandatory access control (MAC) framework that confines programs to a limited set of resources, and is enabled by default on Ubuntu, Debian, and SUSE distributions. The vulnerabilities have existed since Linux kernel version 4.11 (2017), impacting an estimated 12.6 million enterprise Linux systems worldwide.

The core vulnerability class is "confused deputy" — AppArmor's securityfs pseudo-files (.load, .replace, .remove) under /sys/kernel/security/apparmor/ are created with world-writable permissions (mode 0666), allowing any unprivileged user to open them for writing. While direct writes fail with EACCES, attackers can use the dup2() syscall to redirect a privileged program's output (such as su in PTY mode) through these file descriptors, effectively loading, replacing, or removing arbitrary AppArmor profiles with full kernel privileges.

Vulnerability 1 (Confused Deputy, CWE-269): The fundamental flaw enabling all subsequent attacks. Unprivileged users open securityfs pseudo-files in O_WRONLY mode, then use dup2() to redirect privileged program stderr to these descriptors. The su command with -P (PTY) flag writes controlled binary data including null bytes, enabling arbitrary profile manipulation. This allows attackers to remove protective profiles from system services (rsyslogd, cupsd), load restrictive deny-all profiles causing denial of service, and bypass Ubuntu's unprivileged user-namespace restrictions.

Vulnerability 2 (Uncontrolled Recursion, CWE-674): The __remove_profile() function recursively calls itself via __aa_profile_list_release() without depth limits when processing nested subprofiles. An attacker can create deeply nested profile hierarchies (1024 levels: "a//x//x//x...") and trigger removal, exhausting the 16KB kernel stack on x86_64 systems. CONFIG_VMAP_STACK guard pages prevent arbitrary code execution, limiting impact to complete system crash (denial of service).

Vulnerability 3 (Out-of-Bounds Read, CWE-125): The match_char() macro evaluates arguments multiple times, causing the string pointer to increment multiple times due to MATCH_FLAG_DIFF_ENCODE logic. By crafting DFA matching patterns with wildcards followed by specific ranges, attackers can read up to 64KB past the allocated 8KB kmalloc buffer, disclosing KASLR-randomized kernel pointers including aa_global_buffers, shmem_ops, and noop_backing_dev_info addresses.

Vulnerability 4 (Use-After-Free, CWE-416): aa_loaddata structures in the kmalloc-192 slab cache are referenced by securityfs dentries without proper refcounting. A race condition exists between path_openat() acquiring a dentry reference and do_dentry_open() calling seq_rawdata_open(), while concurrent profile removal triggers kfree_sensitive() via delayed work. The race window can be widened to seconds by loading profiles with massive DFAs (~64K states). Exploitation on Ubuntu 24.04.3 involves cross-cache attacks, page table takeover via Jann Horn's technique (CVE-2020-29661), mapping /etc/passwd pages through re-allocated page tables, and writing a passwordless root entry. This is the most severe vulnerability, enabling reliable local privilege escalation to root.

Vulnerability 5 (Double-Free, CWE-415): In aa_replace_profiles(), the namespace name pointer ns_name is freed twice — first via aa_load_ent_free() at line 1262, then again via kfree(ns_name) at line 1270. The race window can be expanded to several seconds by writing 1024+ profiles with 16 subprofiles each. Exploitation on Debian 13.1 uses AF_PACKET page vectors and signalfd(-1) calls to achieve arbitrary credential modification, zeroing uid for root access. CONFIG_SLAB_BUCKETS is bypassed using user-key and AF_PACKET buffers.

Vulnerabilities 6-9 include a memory leak in verify_header(), missing namespace depth limits, out-of-bounds read/write in the DFA DEFAULT transition table, and an infinite loop in differential encoding verification.

A separate user-space local privilege escalation chain combines the confused deputy vulnerability with sudo and Postfix: loading an AppArmor profile that denies CAP_SETUID to /usr/bin/sudo causes sudo's setresuid() call to fail silently, then sudo executes sendmail (Postfix) while still running as root. The attacker controls Postfix configuration via the MAIL_CONFIG environment variable, achieving arbitrary code execution as root.

Patches were developed across 11 commits and merged upstream to Linus's kernel tree on 2026-03-12. Ubuntu, Debian, and SUSE have released corresponding security updates. No CVE identifiers have been assigned at the time of publication. PoC code has been withheld to allow patching, though detailed exploitation methodology is documented in the Qualys advisory.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1014 Rootkit
- T1222 File and Directory Permissions Modification
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1078 Valid Accounts
- T1499 Endpoint Denial of Service

## Sources

- [CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root — Qualys Blog](https://blog.qualys.com/vulnerabilities-threat-research/2026/03/12/crackarmor-critical-apparmor-flaws-enable-local-privilege-escalation-to-root)
- [CrackArmor Technical Advisory — Qualys TRU](https://www.qualys.com/2026/03/10/crack-armor.txt)
- [Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation — The Hacker News](https://thehackernews.com/2026/03/nine-crackarmor-flaws-in-linux-apparmor.html)
- [AppArmor Vulnerability Fixes Available — Ubuntu Blog](https://ubuntu.com/blog/apparmor-vulnerability-fixes-available)
- [CrackArmor Vulnerabilities — Ubuntu Security](https://ubuntu.com/security/vulnerabilities/crackarmor)
- [Linux Kernel AppArmor Bug — Launchpad #2143853](https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2143853)
- [Sudo Bug — Launchpad #2143042](https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042)
- [Util-linux Bug — Launchpad #2143850](https://bugs.launchpad.net/ubuntu/+source/util-linux/+bug/2143850)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0228