AppArmor mount rules grant excessive permissions

published 2019-04-22 7 y ago modified 2026-06-17 4 mo ago also EUVD-2016-2680

cvss: 3.9; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

In all versions of AppArmor mount rules are accidentally widened when compiled.

Patch / fix

fixed in 1 distros 5

canonical apparmor 2.13.10, 3.0.12, 3.1.6

debian ubuntu opensuse alpine azure linux

apparmor Debian 14, Debian 13 3.0.12-1

debian advisories DEBIAN-CVE-2016-1585

apparmor Ubuntu 20.04 LTS 2.13.3-7ubuntu5.4
apparmor Ubuntu 22.04 LTS 3.0.4-2ubuntu2.4

ubuntu advisories UBUNTU-CVE-2016-1585

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

apparmor openSUSE Tumbleweed 3.1.4-1.1

opensuse advisories openSUSE-SU-2024:12971-1

apparmor Alpine 3.17 3.1.7-r0

alpine advisories ALPINE-CVE-2016-1585

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

apparmor CBL-Mariner 2.0 2.13-16

azure linux advisories AZL-6306

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.0	3.9	CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

AppArmor apparmor

References

bugs.launchpad.net /apparmor/+bug/1597017
issue-tracking, third-party-advisory
lists.apache.org /thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
mailing-list, third-party-advisory

Sources

CVE List CVE-2016-1585
NVD CVE-2016-1585

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary