Executive Summary

This vulnerability exists in the Linux kernel's AppArmor component, specifically in the function aa_get_buffer(). When this function pulls from the per-CPU list, it unconditionally decrements a variable called cache->hold. If hold reaches zero while there are still buffers counted (count is non-zero), the decrement causes an unsigned integer underflow, wrapping hold to a very large value (UINT_MAX).

As a result, hold remains non-zero for a long time, preventing the function aa_put_buffer() from returning buffers to the global list. This can cause starvation of buffers for other CPUs and force repeated memory allocations (kmalloc) of a large size (aa_g_path_max). The fix involves guarding the decrement operation to prevent hold from underflowing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to resource starvation on CPUs other than the one affected. Because buffers are not returned to the global list, other CPUs may run out of available buffers, which forces the system to repeatedly allocate large amounts of memory dynamically.

This repeated allocation can degrade system performance and increase memory usage, potentially leading to instability or denial of service conditions under heavy load.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by guarding the decrement operation in the Linux kernel's apparmor aa_get_buffer function to prevent underflow. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0