Nine Linux AppArmor Flaws in CrackArmor Enable Root Escalation, Container Isolation Bypass

Mar 13
2 min read

Key Findings

* Nine critical vulnerabilities discovered in Linux AppArmor security module

* Enables root escalation and container isolation bypass

* Affects Linux kernels since version 4.11

* Impacts over 12.6 million enterprise Linux instances

* Allows unprivileged users to manipulate security profiles

* Can trigger denial-of-service attacks

* Enables arbitrary code execution within kernel

* No CVE identifiers assigned yet

* Vulnerabilities exist since 2017

Background

AppArmor is a Linux security module providing mandatory access control (MAC) that protects operating systems against external and internal threats. Integrated into the mainline Linux kernel since version 2.6.36, it prevents application vulnerabilities from being exploited by enforcing strict access controls.

The recently discovered vulnerabilities, collectively named "CrackArmor" by Qualys Threat Research Unit (TRU), represent a series of confused deputy flaws. These vulnerabilities allow unprivileged users to manipulate security mechanisms and bypass critical kernel protections.

Vulnerability Mechanics

Confused deputy vulnerabilities occur when a privileged program is tricked into misusing its elevated permissions. In this case, attackers can manipulate AppArmor profiles to disable service protections, create fully-capable user namespaces, and execute unauthorized actions.

Potential Impact

Successful exploitation could enable:

* Local privilege escalation to root

* Bypassing container isolation

* Credential tampering

* Service disruptions

* Kernel address space layout randomization (KASLR) disclosure

Affected Systems

* Linux kernels version 4.11 and later

* Distributions integrating AppArmor by default

* Major targets include Ubuntu, Debian, and SUSE

* Estimated 12.6 million enterprise Linux instances at risk

Mitigation

Qualys recommends immediate kernel patching as the primary mitigation strategy. The research team is deliberately withholding proof-of-concept exploits to provide organizations time to implement fixes.

Researcher Commentary

Saeed Abbasi from Qualys TRU emphasized that "immediate kernel patching remains the non-negotiable priority for neutralizing these critical vulnerabilities."

Sources

https://thehackernews.com/2026/03/nine-crackarmor-flaws-in-linux-apparmor.html
https://unsafe.sh/go-401851.html