[Midnightbsd-cvs] [MidnightBSD/src] 2390f4: sysvsem: fix sequence number wraparound race in se...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 2390f4838a6b366992cbd0a04a1afb87c29a33b8
      https://github.com/MidnightBSD/src/commit/2390f4838a6b366992cbd0a04a1afb87c29a33b8
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-01 (Thu, 01 Oct 2026)

  Changed paths:
    M sys/kern/sysv_sem.c

  Log Message:
  -----------
  sysvsem: fix sequence number wraparound race in semop(2)

semop(2) may sleep waiting for a semaphore.  Upon waking up, it checks
whether the set's sequence number has changed, indicating that the set
was removed.  The sequence number embedded in the IPC identifier is
only 15 bits wide and wraps, so if enough semaphore sets are created
and destroyed in the same table slot while a caller is blocked, the
check produces a false negative and the subsequent access of
semakptr->u.__sem_base[sopptr->sem_num] may be out of bounds.

Fix this by introducing a 64-bit sequence number for each slot in the
semaphore pool, kept in a separate array since userland tools such as
ipcrm(1) embed the layout of struct semid_kernel.  Use it in semop(2),
in the semctl(2) GETALL/SETALL paths (replacing the sem_nsems recheck
added for SA-26:54), and in the undo handling at process exit, where an
out-of-range undo entry is now skipped rather than panicking.

While here, use semvalid() instead of open-coding its implementation,
convert a couple of flags to bool, and use a better variable name to
store required permissions.

An unprivileged local user could trigger an out-of-bounds access on
kernel heap memory, potentially leading to privilege escalation.

Security:       CVE-2026-58098
Security:       FreeBSD-SA-26:64.sysvsem
Obtained from:  FreeBSD 04f841a05836
AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications