Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #94550

Bug#1145111: [PATCH] apparmor: fix NULL ctx->peer derefs in unix socket ctx updates

Cross-posted to 2 groups.

Show all headers | View raw

control: affects -1 netcat-openbsd

Hi,

On 2026-10-20 23:39, Adrian Bunk wrote:
> On Sun, Oct 18, 2026 at 09:34:39AM +0200, Paul Gevers wrote:
> > Hi,
> 
> Hi Paul,
> 
> > I find it a bit difficult to track if either of the patches landed already
> > in the kernel used by the buildds.
> 
> the issue is still seen on the buildds, I think netcat-openbsd today 
> killed buildds on loong64 and in ports on pppc64 and sparc64.

The issue is still present upstream, and thus in the testing, unstable, 
experimental and backports kernels. Two similar patches fixing the issue 
have been posted so far. If the fix is not pushed through the next merge 
window, I think the kernel team should either:
- bypass the policy that the patches need to be merged upstream first
- or disable apparmor in the debian kernel

Please also find below a simpler reproducer, it just needs python to 
crash a default forky installation. What is nice is that it works for 
all architectures without having to special case them.

Regards
Aurelien


#!/usr/bin/env python3
import os, socket, sys

if '--payload' in sys.argv:
  server = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
  server.setsockopt(socket.SOL_SOCKET, socket.SO_PASSCRED, 1)
  server.bind('\0aa-crash-server')

  client = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
  client.connect('\0aa-crash-server')
  os.writev(client.fileno(), [b'\0' * 16])
  sys.exit()

# Run the payload using the unprivileged_userns AA profile
os.execvp('aa-exec', ['aa-exec', '-p', 'unprivileged_userns', '--',
                      sys.executable, os.path.abspath(__file__), '--payload'])


-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                     http://aurel32.net

Back to linux.debian.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1145111: linux: kernel NULL pointer dereference when running snapd testsuite Aurelien Jarno <aurel32@debian.org> - 2026-08-22 20:40 +0200
  Bug#1145111: linux: kernel NULL pointer dereference when running snapd testsuite Aurelien Jarno <aurel32@debian.org> - 2026-08-23 00:10 +0200
    Bug#1145111: linux: kernel NULL pointer dereference when running snapd testsuite Aurelien Jarno <aurel32@debian.org> - 2026-08-23 23:40 +0200
      Bug#1145111: linux: kernel NULL pointer dereference when running snapd testsuite Aurelien Jarno <aurel32@debian.org> - 2026-08-28 06:40 +0200
    Bug#1145111: linux: kernel NULL pointer dereference when running snapd testsuite Aurelien Jarno <aurel32@debian.org> - 2026-09-02 22:40 +0200
  Processed: Re: Bug#1145111: linux: kernel NULL pointer  dereference when running snapd testsuite "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-08-23 00:10 +0200
  Processed: Re: Bug#1145111: linux: kernel NULL pointer  dereference when running snapd testsuite "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-08-28 06:40 +0200
  Processed: Re: Bug#1145111: linux: kernel NULL pointer  dereference when running snapd testsuite "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-09-02 22:40 +0200
  Bug#1145111: [PATCH] apparmor: fix NULL ctx->peer derefs in unix socket ctx updates Paul Gevers <elbrus@debian.org> - 2026-10-18 09:40 +0200
    Bug#1145111: [PATCH] apparmor: fix NULL ctx->peer derefs in unix socket ctx updates Adrian Bunk <bunk@debian.org> - 2026-10-20 22:50 +0200
      Bug#1145111: [PATCH] apparmor: fix NULL ctx->peer derefs in unix socket ctx updates Aurelien Jarno <aurel32@debian.org> - 2026-10-20 23:20 +0200
  Processed: Re: Bug#1145111: [PATCH] apparmor: fix NULL ctx->peer  derefs in unix socket ctx updates "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-10-20 23:20 +0200

csiph-web