[Midnightbsd-cvs] [MidnightBSD/src] 445925: audit: Fix incorrect audit records for ptrace(PT_S...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 44592526068b80552a3576508d5762c356960dff
      https://github.com/MidnightBSD/src/commit/44592526068b80552a3576508d5762c356960dff
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M sys/kern/kern_sig.c

  Log Message:
  -----------
  audit: Fix incorrect audit records for ptrace(PT_SC_REMOTE) syscalls

When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel
passed the return value of the internal setup logic (error) to
AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system
call (tsr->ts_ret.sr_error).  As a result, committed audit records for
remotely executed system calls that failed incorrectly indicated success.

An attacker able to debug a process could exploit this to produce
misleading audit trails, potentially undermining audit-based IDS.

Ported from the FreeBSD fix for SA-26:45.audit (FreeBSD commit
1763deb84ba9), by Kyle Evans.

Security:	FreeBSD-SA-26:45.audit
Security:	CVE-2026-49426
Obtained from:	FreeBSD

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply at anthropic.com>


  Commit: 6d5a2037d1ed0219aa6ed4974b0c366a8c9afa52
      https://github.com/MidnightBSD/src/commit/6d5a2037d1ed0219aa6ed4974b0c366a8c9afa52
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: Note SA-26:45.audit fix

Security:	FreeBSD-SA-26:45.audit
Security:	CVE-2026-49426

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply at anthropic.com>


Compare: https://github.com/MidnightBSD/src/compare/6fd9c242acf4...6d5a2037d1ed

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications