CVE-2017-6507

What it actually does

Incorrect handling of unknown AppArmor profiles in init scripts, upstart jobs, and systemd unit files removes confinement for processes whose profiles reside outside standard filesystem locations such as /etc/apparmor.d/.

Why it matters to the business

Processes that should run under mandatory access controls may execute without restrictions, increasing the chance of unauthorized actions or container escapes in environments using tools that manage their own profiles; the issue has been public for years with low exploitation probability and no known ransomware use.

How an attack unfolds

An attacker triggers a restart of an affected service via the AppArmor-managed init system; the restart logic unloads any profile not found in typical directories, leaving the target process unconfined and expanding its attack surface for follow-on actions.

How to fix it

Upgrade affected packages to the listed fixed versions: imagemagick on Debian 11/12/13 to 8:6.9.7.4+dfsg-13, on Ubuntu 14.04 LTS to 8:6.7.7.10-6ubuntu3.11, and on Ubuntu 16.04 LTS to 8:6.8.9.9-7ubuntu5.11; verify AppArmor profile loading after upgrade.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases, then restart the relevant services and inspect AppArmor status to ensure profiles in non-standard directories remain loaded.

Typical attack path

1. Identify a service or container runtime that relies on a non-standard AppArmor profile location
2. Trigger a restart operation through the system init mechanism
3. Confirm the profile is removed due to the flawed handling logic
4. Execute actions against the now-unconfined process that were previously blocked

How to detect it

Review system and AppArmor logs around service restart events for unexpected profile unload messages; examine process confinement status before and after restarts on systems running the vulnerable package versions.

What your security team should do

• Apply the specified package upgrades immediately on all affected systems
• Audit any custom AppArmor profile locations used by container or image-processing workloads
• Test service restarts in a lab environment to validate profile persistence post-upgrade
• Monitor for future AppArmor-related packaging updates even on legacy distributions