{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/apparmor-flatpak-profile/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:5.18:rc7:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-46331"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AppArmor","aa-exec","AppArmor trinity profile","AppArmor chrome profile","AppArmor flatpak profile"],"_cs_severities":["high"],"_cs_tags":["linux","privilege-escalation","apparmor","cve","endpoint"],"_cs_type":"advisory","_cs_vendors":["Ubuntu"],"content_html":"\u003cp\u003eCVE-2026-46331 describes a privilege escalation vulnerability on Linux systems, specifically targeting the \u003ccode\u003eaa-exec\u003c/code\u003e utility when combined with certain AppArmor profiles like \u003ccode\u003etrinity\u003c/code\u003e, \u003ccode\u003echrome\u003c/code\u003e, or \u003ccode\u003eflatpak\u003c/code\u003e. This vulnerability allows attackers to bypass Ubuntu's unprivileged user namespace restrictions by tricking \u003ccode\u003eaa-exec\u003c/code\u003e into granting namespace-creation capabilities to an arbitrary binary, rather than the legitimate application the profile was intended to confine. Defenders should be aware that adversaries may exploit this to gain elevated privileges, enabling further compromise of the system. Detection focuses on instances where \u003ccode\u003eaa-exec\u003c/code\u003e is invoked with specific profile arguments (\u003ccode\u003e-p\u003c/code\u003e, \u003ccode\u003e--\u003c/code\u003e) and when the \u003ccode\u003eaa-exec\u003c/code\u003e binary itself is executed from unexpected or non-standard directory paths, signaling an attempt to exploit this bypass. This technique can lead to full system compromise if successful.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial user-level access to a vulnerable Linux system.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a \u003ccode\u003eaa-exec\u003c/code\u003e configuration on the system that utilizes \u003ccode\u003euserns\u003c/code\u003e-carrying AppArmor profiles, such as \u003ccode\u003etrinity\u003c/code\u003e, \u003ccode\u003echrome\u003c/code\u003e, or \u003ccode\u003eflatpak\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious command that invokes \u003ccode\u003eaa-exec\u003c/code\u003e with arguments specifying one of the vulnerable AppArmor profiles (e.g., \u003ccode\u003e-p flatpak\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe crafted command includes the \u003ccode\u003e--\u003c/code\u003e separator, followed by a path to an arbitrary, attacker-controlled binary (e.g., a shell or a privilege escalation tool).\u003c/li\u003e\n\u003cli\u003eTo evade detection, the attacker ensures the \u003ccode\u003eaa-exec\u003c/code\u003e binary itself is executed from a non-standard or unusual directory path, outside of common system locations or application bundles.\u003c/li\u003e\n\u003cli\u003eUpon execution, the vulnerable \u003ccode\u003eaa-exec\u003c/code\u003e utility is tricked into granting namespace-creation capabilities to the attacker's arbitrary binary.\u003c/li\u003e\n\u003cli\u003eThe arbitrary binary executes with elevated privileges, bypassing AppArmor and unprivileged user namespace restrictions, achieving privilege escalation on the system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-46331 grants attackers privilege escalation on affected Linux systems, particularly Ubuntu. This can lead to a full system compromise, allowing attackers to execute arbitrary code with root privileges. The impact includes unauthorized access to sensitive data, installation of persistent backdoors, modification of system configurations, or deployment of additional malicious payloads such as ransomware or cryptocurrency miners. Organizations using vulnerable Linux distributions could face significant operational disruption and data loss.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-46331 on all affected Ubuntu systems immediately to prevent privilege escalation.\u003c/li\u003e\n\u003cli\u003eDeploy the \u003ccode\u003eDetects CVE-2026-46331 Exploitation - Linux AppArmor Bypass via aa-exec\u003c/code\u003e Sigma rule to your SIEM for early detection of exploitation attempts.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon for Linux EventID 1 to ensure process creation events are collected, which is essential for activating the detection rule.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T15:28:33Z","date_published":"2026-07-24T15:28:33Z","id":"https://feed.craftedsignal.io/briefs/2026-07-apparmor-bypass/","summary":"Adversaries can exploit CVE-2026-46331 to bypass AppArmor and unprivileged user namespace restrictions on Linux systems by abusing the `aa-exec` utility with `trinity`, `chrome`, or `flatpak` AppArmor profiles, leading to privilege escalation when the `aa-exec` binary itself is executed from a non-standard path.","title":"Linux AppArmor Bypass via aa-exec (CVE-2026-46331)","url":"https://feed.craftedsignal.io/briefs/2026-07-apparmor-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - AppArmor Flatpak Profile","version":"https://jsonfeed.org/version/1.1"}