# CrackArmor: Confused Deputy Vulnerabilities in Linux AppArmor

- **Artifact ID:** CHQ-EX-2026-006
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-006
- **Machine-record SHA-256:** `6424491837d935b4687b39898024ca7e5aa8e709e869b1650bc044c76d810bdd`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-006",
  "title": "CrackArmor: Confused Deputy Vulnerabilities in Linux AppArmor",
  "subtitle": "Observed vulnerabilities in Linux AppArmor Security Module enabling privilege escalation, denial of service, container breakout, and KASLR bypass",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, security vulnerabilities, and industry practices as they existed during the periods described. This Exhibit records observed vulnerability conditions, default configurations, and operational norms as documented in vendor advisories, security research, and enterprise operating documentation during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (2017–2026-03-12)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "CONTEXT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2017-01-01",
    "temporal_end": "2026-03-12"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Vulnerability Name: CrackArmor. Affected Component: Linux AppArmor Security Module (LSM). Flaw Class: Confused deputy vulnerabilities (9 total). Present Since: Linux kernel v4.11, released 2017. Duration Undetected: Approximately 9 years. Exposure Scale: 12.6 million enterprise Linux instances globally.",
        "Affected Distributions: Ubuntu, Debian, SUSE and all derivatives running AppArmor by default. Attack Requirement: Unprivileged local user account only. No administrative credentials required.",
        "Mechanism: Unprivileged actor manipulates trusted privileged tools (Sudo, Postfix) to write to AppArmor pseudo-files at /sys/kernel/security/apparmor/.load, .replace, .remove.",
        "Consequence — Local Privilege Escalation: Local privilege escalation to full root via user-space and kernel-space paths including use-after-free overwriting /etc/passwd.",
        "Consequence — Denial of Service: Kernel stack exhaustion via deeply nested subprofile removal, triggering kernel panic and forced reboot.",
        "Consequence — Container Breakout: Escape container restrictions to gain host environment control.",
        "Consequence — KASLR Bypass: Out-of-bounds reads bypass kernel address space layout randomization.",
        "Silent Failure Mode: Security boundary fails silently. AppArmor unloads profiles during upgrades or restarts without administrator alert. Dashboards report normal status.",
        "CVE Assignment: None assigned at disclosure. Upstream kernel team process delays CVE issuance 1–2 weeks after stable fix. Proof of Concept: Full attack chain PoC developed by Qualys TRU. Withheld from public release to allow patch deployment.",
        "Disclosure Date: March 12, 2026. Patch Status at Disclosure: Debian patched March 12, 2026. Ubuntu and SUSE patches in progress. Discovering Organization: Qualys Threat Research Unit (TRU)."
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "AppArmor is designed to enforce mandatory access control by restricting the capabilities of individual applications. The CrackArmor vulnerabilities exploit a confused deputy condition: an unprivileged actor cannot modify security policies directly, but can manipulate trusted privileged processes to perform those modifications on their behalf.",
        "The security boundary fails silently. AppArmor profiles can be unloaded during upgrades or service restarts without triggering administrator alerts. During the failure window, processes run unconfined. No monitoring system receives notification of the change in enforcement state.",
        "The condition persisted undetected from 2017 to 2026 across the default configuration of three major Linux distributions and their cloud, Kubernetes, IoT, and edge deployments.",
        "Qualys CTO statement at disclosure: 'Patching alone is not enough; we must re-examine our entire assumption of what default configurations mean for our infrastructure.'"
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-ED-2026-009 — Evidence Docket: Update Channels as Ungoverned Trust Execution Surfaces.",
        "CHQ-ED-2026-011 — Evidence Docket: Deployed Security Tool Presence Cannot Serve as Evidence of Functioning Control."
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No evaluative judgment is made about any organization, vendor, or security posture.\n\nTemporal scope reflects the period during which the vulnerability was present and undetected (2017 to disclosure on March 12, 2026). Exhibit issuance date is March 14, 2026.\n\nSource: Qualys Threat Research Unit advisory, March 12, 2026. Corroborating coverage: The Hacker News, Cybersecurity News, IT Pro, Techzine, SecurityOnline.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-03-14"
}
```