#1038945 linux: kernel null pointer dereference loading an invalid AppArmor profile, regression since 6.1

Package:
src:linux
Source:
src:linux
Submitter:
Simon McVittie
Date:
2026-01-10 11:02:38 UTC
Severity:
normal
Tags:
#1038945#5
Date:
2023-06-23 14:36:37 UTC
From:
To:
The AppArmor profile in quake4:i386 from src:game-data-packager (attached
as "bad.txt") is loaded successfully by Debian 12 and older, albeit with
some warnings about uses of sanitized_helper in the xdgopen child profile
(which were probably always wrong).

Since unstable was upgraded from Linux 6.1 to 6.3, I get a null pointer
dereference when I load that profile, and the boot process hangs and
will not complete.

The null pointer dereference is easily reproduced by logging in to a
virtual machine recently generated by autopkgtest-build-qemu, as root,
and loading the offending profile with `apparmor_parser -Tr bad.txt`:

Jun 23 14:19:01 host kernel: audit: type=1400 audit(1687529941.812:11): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="quake4" pid=1098 comm="apparmor_parser"
Jun 23 14:19:01 host kernel: audit: type=1400 audit(1687529941.836:12): apparmor="STATUS" operation="profile_load" profile="unconfined" name="quake4//xdgopen" pid=1098 comm="apparmor_parser"
Jun 23 14:19:01 host kernel: BUG: kernel NULL pointer dereference, address: 0000000000000030
Jun 23 14:19:01 host kernel: #PF: supervisor read access in kernel mode
Jun 23 14:19:01 host kernel: #PF: error_code(0x0000) - not-present page
Jun 23 14:19:01 host kernel: PGD 0 P4D 0
Jun 23 14:19:01 host kernel: Oops: 0000 [#1] PREEMPT SMP PTI
Jun 23 14:19:01 host kernel: CPU: 0 PID: 1098 Comm: apparmor_parser Not tainted 6.3.0-1-amd64 #1  Debian 6.3.7-1
Jun 23 14:19:01 host kernel: Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Jun 23 14:19:01 host kernel: RIP: 0010:aafs_create.constprop.0+0x6a/0x110
Jun 23 14:19:01 host kernel: Code: 39 9e 48 89 0c 24 89 c3 e8 23 5c f0 ff 85 c0 74 19 48 63 e8 48 83 c4 10 48 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc <4d> 8b 54 24 30 4d 8d ba a0 00 00 00 4c 89 54 24 08 4c 89 ff e8 1d
Jun 23 14:19:01 host kernel: RSP: 0018:ffffa809c0797c80 EFLAGS: 00010246
Jun 23 14:19:01 host kernel: RAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000
Jun 23 14:19:01 host kernel: RDX: 0000000000000001 RSI: ffffffff9e393768 RDI: 0000000000000000
Jun 23 14:19:01 host kernel: RBP: ffffffff9c632b8a R08: 0000000000000000 R09: 0000000000000000
Jun 23 14:19:01 host kernel: R10: ffff8e2941d22340 R11: 0000000000000000 R12: 0000000000000000
Jun 23 14:19:01 host kernel: R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Jun 23 14:19:01 host kernel: FS:  00007f7d64f2c740(0000) GS:ffff8e2ab7c00000(0000) knlGS:0000000000000000
Jun 23 14:19:01 host kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Jun 23 14:19:01 host kernel: CR2: 0000000000000030 CR3: 000000010d3e2003 CR4: 0000000000370ef0
Jun 23 14:19:01 host kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Jun 23 14:19:01 host kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Jun 23 14:19:01 host kernel: Call Trace:
Jun 23 14:19:01 host kernel:  <TASK>
Jun 23 14:19:01 host kernel:  ? __die+0x23/0x70
Jun 23 14:19:01 host kernel:  ? page_fault_oops+0x17d/0x4c0
Jun 23 14:19:01 host kernel:  ? exc_page_fault+0x74/0x170
Jun 23 14:19:01 host kernel:  ? asm_exc_page_fault+0x26/0x30
Jun 23 14:19:01 host kernel:  ? aafs_create.constprop.0+0x6a/0x110
Jun 23 14:19:01 host kernel:  __aafs_profile_mkdir+0x366/0x400
Jun 23 14:19:01 host kernel:  aa_replace_profiles+0x844/0x1270
Jun 23 14:19:01 host kernel:  policy_update+0xbf/0x150
Jun 23 14:19:01 host kernel:  profile_replace+0xa5/0x120
Jun 23 14:19:01 host kernel:  ? security_file_permission+0x33/0x60
Jun 23 14:19:01 host kernel:  vfs_write+0xc8/0x410
Jun 23 14:19:01 host kernel:  ? fpregs_assert_state_consistent+0x26/0x50
Jun 23 14:19:01 host kernel:  ? exit_to_user_mode_prepare+0x40/0x1d0
Jun 23 14:19:01 host kernel:  ksys_write+0x6f/0xf0
Jun 23 14:19:01 host kernel:  do_syscall_64+0x5c/0xc0
Jun 23 14:19:01 host kernel:  ? syscall_exit_to_user_mode+0x1b/0x40
Jun 23 14:19:01 host kernel:  ? do_syscall_64+0x6b/0xc0
Jun 23 14:19:01 host kernel:  ? exit_to_user_mode_prepare+0x40/0x1d0
Jun 23 14:19:01 host kernel:  ? syscall_exit_to_user_mode+0x1b/0x40
Jun 23 14:19:01 host kernel:  ? do_syscall_64+0x6b/0xc0
Jun 23 14:19:01 host kernel:  ? do_syscall_64+0x6b/0xc0
Jun 23 14:19:01 host kernel:  ? do_syscall_64+0x6b/0xc0
Jun 23 14:19:01 host kernel:  entry_SYSCALL_64_after_hwframe+0x72/0xdc
Jun 23 14:19:01 host kernel: RIP: 0033:0x7f7d650270e0
Jun 23 14:19:01 host kernel: Code: 40 00 48 8b 15 21 9d 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d 01 25 0e 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
Jun 23 14:19:01 host kernel: RSP: 002b:00007ffd587e0358 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
Jun 23 14:19:01 host kernel: RAX: ffffffffffffffda RBX: 00005592d8b2ef10 RCX: 00007f7d650270e0
Jun 23 14:19:01 host kernel: RDX: 00000000000049c9 RSI: 00005592d9023330 RDI: 0000000000000004
Jun 23 14:19:01 host kernel: RBP: 00000000000049c9 R08: 00000000000049c9 R09: 0000000000000000
Jun 23 14:19:01 host kernel: R10: 0000000000000000 R11: 0000000000000202 R12: 00005592d9023330
Jun 23 14:19:01 host kernel: R13: 0000000000000004 R14: 0000000000000007 R15: 00005592d8b61b30
Jun 23 14:19:01 host kernel:  </TASK>
Jun 23 14:19:01 host kernel: Modules linked in: isofs binfmt_misc intel_rapl_msr intel_rapl_common intel_pmc_core kvm_intel kvm irqbypass ghash_clmulni_intel sha512_ssse3 sha512_generic snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core aesni_intel snd_hwdep crypto_simd cryptd snd_pcm qxl rapl drm_ttm_helper snd_timer ttm snd virtio_rng iTCO_wdt intel_pmc_bxt iTCO_vendor_support pcspkr drm_kms_helper watchdog rng_core soundcore virtio_balloon joydev button evdev serio_raw sg fuse loop drm efi_pstore dm_mod configfs qemu_fw_cfg ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2 crc32c_generic hid_generic usbhid hid sr_mod cdrom sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif ahci crct10dif_generic libahci xhci_pci virtio_net net_failover libata xhci_hcd sym53c8xx scsi_transport_spi crct10dif_pclmul crct10dif_common failover virtio_console crc32_pclmul i2c_i801 psmouse scsi_mod usbcore i2c_smbus crc32c_intel lpc_ich virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev virtio
Jun 23 14:19:01 host kernel:  scsi_common usb_common virtio_ring
Jun 23 14:19:01 host kernel: CR2: 0000000000000030
Jun 23 14:19:01 host kernel: ---[ end trace 0000000000000000 ]---
Jun 23 14:19:01 host kernel: RIP: 0010:aafs_create.constprop.0+0x6a/0x110
Jun 23 14:19:01 host kernel: Code: 39 9e 48 89 0c 24 89 c3 e8 23 5c f0 ff 85 c0 74 19 48 63 e8 48 83 c4 10 48 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc <4d> 8b 54 24 30 4d 8d ba a0 00 00 00 4c 89 54 24 08 4c 89 ff e8 1d
Jun 23 14:19:01 host kernel: RSP: 0018:ffffa809c0797c80 EFLAGS: 00010246
Jun 23 14:19:01 host kernel: RAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000
Jun 23 14:19:01 host kernel: RDX: 0000000000000001 RSI: ffffffff9e393768 RDI: 0000000000000000
Jun 23 14:19:01 host kernel: RBP: ffffffff9c632b8a R08: 0000000000000000 R09: 0000000000000000
Jun 23 14:19:01 host kernel: R10: ffff8e2941d22340 R11: 0000000000000000 R12: 0000000000000000
Jun 23 14:19:01 host kernel: R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Jun 23 14:19:01 host kernel: FS:  00007f7d64f2c740(0000) GS:ffff8e2ab7c00000(0000) knlGS:0000000000000000
Jun 23 14:19:01 host kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Jun 23 14:19:01 host kernel: CR2: 0000000000000030 CR3: 000000010d3e2003 CR4: 0000000000370ef0
Jun 23 14:19:01 host kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Jun 23 14:19:01 host kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Jun 23 14:19:01 host kernel: note: apparmor_parser[1098] exited with irqs disabled

This doesn't seem like a security issue since you need CAP_MAC_ADMIN to
trigger it.

The attached "good.txt" works fine, and is what I'm going to use to
replace the profile in quake4:i386 to work around this. Please send any
advice/complaints/patches for the profile itself to game-data-packager
on the bug tracking system: making the profile better is out of scope
for this particular bug report.

(I'm aware that my throwaway VM image is now unsupported and needs
regenerating as merged-/usr, since it's non-merged-/usr and we are now
in the trixie release cycle, but I don't think that has anything to
do with the bug I'm reporting, which was originally reproduced on a
merged/-usr laptop.)

    smcv
#1038945#22
Date:
2023-09-08 17:52:23 UTC
From:
To:
Also reproduced here, amd64 host, the only package updated from bookworm
is the linux-image-6.4.0-0.deb12.2-amd64 & headers. The worst thing is
that this issue makes the kernel crash during the boot, leaving the
system remotely inaccessible.
#1038945#27
Date:
2023-09-08 18:58:26 UTC
From:
To:
Can you test whether the bug is still present in 6.4.13?
Testing with 6.5.1 from Experimental may be useful too.
#1038945#32
Date:
2023-09-11 10:21:05 UTC
From:
To:
Control: found -1 6.4.13-1
Control: found -1 6.5.1-1~exp1

The bug is still present in both versions.

This should be straightforward for anyone interested in this bug to
reproduce without my help, you don't need any special packages installed
(the invalid profile was originally from the quake4 package, but the bug
can easily be reproduced without quake4). Steps:

- Have a real or virtual machine with apparmor (I used a qemu VM in
  virt-manager, running an image produced by autopkgtest-build-qemu)
- Download
https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1038945;filename=bad.txt;msg=5
  and copy it onto the test machine
- Run as root: "apparmor_parser -Tr /path/to/bad.txt"
- Expected result: successfully loaded or gracefully rejected (either one
  would be OK)
- Actual result: a null pointer dereference similar to my initial report

    smcv
#1038945#41
Date:
2026-01-10 10:10:20 UTC
From:
To:
Es gibt eine Familienspende in Höhe von 1.850.000,00 USD von Cheng Charlie
Saephan. Bitte antworten Sie für weitere Informationen. Denken Sie daran,
Ihrer Familie und den Bedürftigen in Ihrer Umgebung Gutes zu tun.

Dies ist bereits der zweite Versuch, Sie zu erreichen. Bitte antworten Sie
für weitere Details.
#1038945#46
Date:
2026-01-10 10:10:20 UTC
From:
To:
Es gibt eine Familienspende in Höhe von 1.850.000,00 USD von Cheng Charlie
Saephan. Bitte antworten Sie für weitere Informationen. Denken Sie daran,
Ihrer Familie und den Bedürftigen in Ihrer Umgebung Gutes zu tun.

Dies ist bereits der zweite Versuch, Sie zu erreichen. Bitte antworten Sie
für weitere Details.