CVE-2022-50860

What it actually does

The flaw is a memory leak in AppArmor alloc_ns() where the hname member of struct aa_policy, after profile name sharing changes, is a subset of a slab object that cannot be freed with kfree_sensitive(), leaving allocated memory unreclaimed.

Why it matters to the business

Over time, repeated operations involving AppArmor policy allocation and replacement can exhaust kernel memory, potentially leading to degraded system performance or instability in environments using mandatory access controls.

How an attack unfolds

An attacker with the ability to trigger repeated AppArmor profile replacements or namespace allocations could cause gradual memory exhaustion; no public exploitation or named threat actors are associated with this issue.

How to fix it

Update the Linux kernel to a version containing commit 9a32aa87a25d800b2c6f47bc2749a7bfd9a486f3 or apply the equivalent fix that replaces kfree_sensitive() with aa_policy_destroy() in alloc_ns(); for affected Debian packages update libsass to 3.5.5-4 or later.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or that AppArmor policy allocation paths use aa_policy_destroy(); review kernel build logs or source for the corrected freeing logic in alloc_ns().

Typical attack path

1. Obtain local access or trigger conditions that cause AppArmor policy operations
2. Perform repeated profile load/replace actions that invoke alloc_ns()
3. Accumulate unreclaimed memory allocations until resource pressure occurs

How to detect it

Review kernel logs for repeated AppArmor allocation warnings or OOM events correlated with policy operations; inspect memory leak checkers or slab usage statistics for aa_policy objects after profile activity.

What your security team should do

• Prioritize kernel updates on systems using AppArmor for mandatory access control
• Monitor memory usage trends on long-running systems with frequent policy changes
• Apply the fix in all stable kernel trees and rebuild custom kernels if needed