[Midnightbsd-cvs] [MidnightBSD/src] 837218: hwpmc: detach PMCs on exec of setuid/setgid binaries

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 83721860c21345333193f2e1a525f73db288ab95
      https://github.com/MidnightBSD/src/commit/83721860c21345333193f2e1a525f73db288ab95
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M UPDATING
    M sys/dev/hwpmc/hwpmc_mod.c

  Log Message:
  -----------
  hwpmc: detach PMCs on exec of setuid/setgid binaries

pmc_can_attach() returned the negation of its decision: callers treat a
zero return as "may attach", but the function returned !decline_attach,
so a declined attach reported success and an allowed one reported
failure.  Its only caller is the PMC_FN_PROCESS_EXEC handler, which
detaches PMCs from a process whose credentials changed across execve(2).
With the inverted result, PMCs were detached only when the owner still
had the privilege to keep them, and were left attached when it did not.

An unprivileged local user who had attached PMCs to a process could
therefore continue monitoring it after it executed a setuid or setgid
image.

Return EPERM when the attach is declined and 0 otherwise.

This is CVE-2026-58089 / FreeBSD-SA-26:56.hwpmc.

Signed-off-by: Lucas Holt <luke at foolishgames.com>
AI-Assisted-by: Claude Opus 5



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications