Three security bypasses have been discovered in Ubuntu Linux’s unprivileged user namespace restrictions, which could be enable a local attacker to exploit vulnerabilities in kernel components.

The issues allow local unprivileged users to create user namespaces with full administrative capabilities and impact Ubuntu versions 23.10, where unprivileged user namespaces restrictions are enabled, and 24.04 which has them active by default.

Linux user namespaces allow users to act as root inside an isolated sandbox (namespace) without having the same privileges on the host.

Ubuntu added AppArmor-based restrictions in version 23.10 and enabled them by default in 24.04 to limit the risk of namespace misuse.

Researchers at cloud security and compliance company Qualys found that these restrictions can be bypassed in three different ways.

“Qualys TRU uncovered three distinct bypasses of these namespace restrictions, each enabling local attackers to create user namespaces with full administrative capabilities,” the researchers say.

“These bypasses facilitate exploiting vulnerabilities in kernel components requiring powerful administrative privileges within a confined environment” - Qualys

The researchers note that these bypasses are dangerous when combined with kernel-related vulnerabilities, and they are not enough to obtain complete control of the system.

Qualys provides technical details for the three bypass methods, which are summarized as follows:

1. Bypass via aa-exec: Users can exploit the aa-exec tool, which allows running programs under specific AppArmor profiles. Some of these profiles - like trinity, chrome, or flatpak - are configured to allow creating user namespaces with full capabilities. By using the unshare command through aa-exec under one of these permissive profiles, an unprivileged user can bypass the namespace restrictions and increase privileges within a namespace.
2. Bypass via busybox: The busybox shell, installed by default on both Ubuntu Server and Desktop, is associated with an AppArmor profile that also permits unrestricted user namespace creation. An attacker can launch a shell via busybox and use it to execute unshare, successfully creating a user namespace with full administrative capabilities.
3. Bypass via LD_PRELOAD: This technique leverages the dynamic linker’s LD_PRELOAD environment variable to inject a custom shared library into a trusted process. By injecting a shell into a program like Nautilus - which has a permissive AppArmor profile - an attacker can launch a privileged namespace from within that process, bypassing the intended restrictions.

Qualys notified the Ubuntu security team of their findings on January 15 and agreed to a coordinated release. However, the busybox bypass was discovered independently by vulnerability researcher Roddux, who published the details on March 21.

Canonical’s response and mitigations

Canonical, the organization behind Ubuntu Linux, has acknowledged Qualys’ findings and confirmed to BleepingComputer that they are developing improvements to the AppArmor protections.

A spokesperson told us that they are not treating these findings as vulnerabilities per se but as limitations of a defense-in-depth mechanism. Hence, protections will be released according to standard release schedules and not as urgent security fixes.

In a bulletin published on the official discussion forum (Ubuntu Discourse), the company shared the following hardening steps that administrators should consider:

• Enable kernel.apparmor_restrict_unprivileged_unconfined=1 to block aa-exec abuse. (not enabled by default)
• Disable broad AppArmor profiles for busybox and Nautilus, which allow namespace creation.
• Optionally apply a stricter bwrap AppArmor profile for applications like Nautilus that rely on user namespaces.
• Use aa-status to identify and disable other risky profiles.