[Midnightbsd-cvs] [MidnightBSD/src] 652567: tty: revalidate the terminal after relocking in TI...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 652567fbb4e827fe9e246319fb6278b271bf4b6f
      https://github.com/MidnightBSD/src/commit/652567fbb4e827fe9e246319fb6278b271bf4b6f
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M UPDATING
    M sys/kern/tty.c

  Log Message:
  -----------
  tty: revalidate the terminal after relocking in TIOCSCTTY and TIOCSPGRP

Both ioctls drop the tty lock so that they can take proctree_lock in the
correct order, then simply tty_lock() again.  Nothing was rechecked
after relocking, so a terminal that was being destroyed in the window
could still be linked into the calling process' session, leaving a
freed tty reachable through it.  An unprivileged local user could race
this to escalate privileges.

Relock with ttydev_enter(), which fails with ENXIO once the device is
gone or fully closed, and return that error with the tty relocked as the
caller expects.

This is CVE-2026-58093 / FreeBSD-SA-26:62.tty.

Obtained from:	FreeBSD
Signed-off-by: Lucas Holt <luke at foolishgames.com>
AI-Assisted-by: Claude Opus 5


  Commit: 99f13408f95dff486a818414660f9032712be485
      https://github.com/MidnightBSD/src/commit/99f13408f95dff486a818414660f9032712be485
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M UPDATING
    M sys/kern/uipc_shm.c
    M sys/sys/mman.h

  Log Message:
  -----------
  posixshm: fix a TOCTOU race in the FIOSSHMLPGCNF handler

The FIOSSHMLPGCNF handler validated conf->psind against the object's
existing shm_lp_psind before taking the rangelock, and only then
assigned it.  Two threads could each see an unconfigured object and
proceed, so an object could end up with psind == 2 while only
pagesizes[1] worth of pages had been populated for it, which an
unprivileged local user can use to escalate privileges.

Acquire the rangelock before the checks and drop it on each error path.
While here, make shm_write() test shm_lp_psind under the rangelock too,
and have shm_mmap_large() assert that its caller holds it.

This is CVE-2026-58094 / FreeBSD-SA-26:63.posixshm.

Obtained from:	FreeBSD
Signed-off-by: Lucas Holt <luke at foolishgames.com>
AI-Assisted-by: Claude Opus 5


Compare: https://github.com/MidnightBSD/src/compare/b7e1a31adeb4...99f13408f95d

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications