CVE-2017-6507

Name	CVE-2017-6507
Description	An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	858768

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
apparmor (PTS)	jessie	2.9.0-3	vulnerable
	stretch	2.11.0-3+deb9u2	fixed
	buster	2.13.2-10	fixed
	bullseye	2.13.6-10	fixed
	bookworm	3.0.8-3	fixed
	sid, trixie	3.1.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
apparmor	source	(unstable)	2.11.0-3			858768

Notes

[jessie] - apparmor <no-dsa> (Minor issue)
[wheezy] - apparmor <no-dsa> (Experimental/unsupported feature)
http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3647
http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3648
https://bugs.launchpad.net/apparmor/+bug/1668892
affects only third-party rules, e.g. from Docker or LXC
LXC in wheezy doesn't support proper isolation