[Midnightbsd-cvs] [MidnightBSD/src] e10262: sysvsem: fix heap out-of-bounds access in semctl(2...

[Lucas Holt]

  Branch: refs/heads/stable/4.1
  Home:   https://github.com/MidnightBSD/src
  Commit: e10262adb9b48e305f154899c2d01e34f9fb1e5d
      https://github.com/MidnightBSD/src/commit/e10262adb9b48e305f154899c2d01e34f9fb1e5d
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-02 (Sun, 02 Aug 2026)

  Changed paths:
    M sys/kern/sysv_sem.c

  Log Message:
  -----------
  sysvsem: fix heap out-of-bounds access in semctl(2) GETALL/SETALL

The GETALL and SETALL commands recorded the number of semaphores in the
target set, dropped the lock protecting the set, allocated a buffer sized
for that count, and reacquired the lock.  Only semvalid()'s sequence
number check guarded against the set being replaced in the interim, but
the sequence number is 15 bits wide and wraps after 0x8000 create/destroy
cycles.  By rapidly destroying and recreating semaphore sets at the same
index, another process can cause the sequence number to wrap so that a
set with a different number of semaphores passes validation.  The
subsequent copy then reads or writes past the end of the allocated buffer.

The existing KASSERT() on the count was compiled out on non-INVARIANTS
kernels, including GENERIC.  Replace it with an unconditional check that
fails with EIDRM when the count changed.

An unprivileged local user could trigger out-of-bounds reads and writes
on kernel heap memory, potentially leading to privilege escalation.

Security:	CVE-2026-58087
Security:	FreeBSD-SA-26:54.sysvsem
Obtained from:	FreeBSD
AI-Assisted-by: Claude Opus 5

Co-Authored-By: Claude Opus 5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>
(cherry picked from commit 996e7fc8a84b69e5cf8c869733db9f0b1408d4cd)



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications