[PATCH] apparmor: fix out-of-bounds read of xmatch perms during exec attachment

[Henry Martin]

verify_profile() validates the accept table indexes of the file
and policy dfas, but never of the attach xmatch dfa. When a policy
carries an explicit xmatch perms table, the blob accept values are
used as indexes into that table unchecked. At exec time,
aa_lookup_perms() uses one as an index into the xmatch perms array
with no bounds check.

The index is a full 32-bit value from the blob, so the read can be
placed gigabytes past the table, across the entire direct map. The
bytes read are interpreted as the allow/deny bits of the exec
request, and the transition outcome is observable by the task,
turning the bug into a bit-per-query read oracle over kernel
memory. An index pointing at unmapped memory oopses in
find_attach() at exec time. E.g. on mainline v7.4-rc1 (KASAN
build):

    BUG: KASAN: slab-out-of-bounds in find_attach+0xc50/0xfe0
    Read of size 4 at addr ffff88810fb2f934 by task su/495
    CPU: 5 UID: 1000 PID: 495 Comm: su
    Call Trace:
     kasan_report
     find_attach
     profile_transition
     apparmor_bprm_creds_for_exec
     bprm_execve
     __x64_sys_execve

Run verify_dfa_accept_index() on the attach xmatch dfa in
verify_profile(), the same check the file and policy dfas already
get.

This issue was discovered by Tencent CodeBuddy Security.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 6f442d42c0d89 ("apparmor: fix profile verification and enable it")
Signed-off-by: Henry Martin <bsdhenrymartin@xxxxxxxxx>
---
 security/apparmor/policy_unpack.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 35dfa3b451f39..054aad13f5e48 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -1593,6 +1593,15 @@ static int verify_profile(struct aa_profile *profile)
 		return -EPROTO;
 	}
 
+	if (profile->attach.xmatch->dfa &&
+	    !verify_dfa_accept_index(profile->attach.xmatch->dfa,
+				     profile->attach.xmatch->size)) {
+		audit_iface(profile, NULL, NULL,
+			    "Unpack: xmatch Invalid named transition", NULL,
+			    -EPROTO);
+		return -EPROTO;
+	}
+
 	if (!verify_perms(rules->file)) {
 		audit_iface(profile, NULL, NULL,
 			    "Unpack: Invalid perm index", NULL, -EPROTO);
-- 
2.43.7