Thus, “there is little impact of not ‘patching’ the vulnerability,” he said. “Organizations using centralized configuration tools like Ansible may deploy these changes with regularly scheduled maintenance or reboot windows.”
Features supposed to improve security
Ironically, last October Ubuntu introduced AppArmor-based features to improve security by reducing the attack surface from unprivileged user namespaces in the Linux kernel. It didn’t quite do that.
“This is an unintended consequence where a security control was put in place but it isn’t fully applied,” said Beggs, “so it allows anyone to push and escalate their privileges.”
Three bypasses
Unprivileged user namespaces are a feature in the Linux kernel that are supposed to provide additional sandboxing functionality for programs such as container runtimes, says Ubuntu. It enables unprivileged users to gain administrator (root) permissions within a confined environment, without giving them elevated permissions on the host system.
However, unprivileged user namespaces have been repeatedly used to exploit kernel vulnerabilities, so the AppArmor restriction added to Ubuntu 23.10 and 24.04 LTS was supposed to act as a security hardening measure.
But Qualys discovered three different bypasses, each of which allows a local attacker to create user namespaces with full administrator capabilities, and therefore to still exploit vulnerabilities in kernel components that require capabilities such as CAP_SYS_ADMIN or CAP_NET_ADMIN:
