[Midnightbsd-cvs] [MidnightBSD/src] 840206: sysvsem: fix sequence number wraparound race in se...

[Lucas Holt]

  Branch: refs/heads/stable/4.1
  Home:   https://github.com/MidnightBSD/src
  Commit: 8402068329a2671013b3c90341b6d3a4169c7166
      https://github.com/MidnightBSD/src/commit/8402068329a2671013b3c90341b6d3a4169c7166
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-01 (Thu, 01 Oct 2026)

  Changed paths:
    M sys/kern/sysv_sem.c

  Log Message:
  -----------
  sysvsem: fix sequence number wraparound race in semop(2)

semop(2) may sleep waiting for a semaphore.  Upon waking up, it checks
whether the set's sequence number has changed, indicating that the set
was removed.  The sequence number embedded in the IPC identifier is
only 15 bits wide and wraps, so if enough semaphore sets are created
and destroyed in the same table slot while a caller is blocked, the
check produces a false negative and the subsequent access of
semakptr->u.__sem_base[sopptr->sem_num] may be out of bounds.

Fix this by introducing a 64-bit sequence number for each slot in the
semaphore pool, kept in a separate array since userland tools such as
ipcrm(1) embed the layout of struct semid_kernel.  Use it in semop(2),
in the semctl(2) GETALL/SETALL paths (replacing the sem_nsems recheck
added for SA-26:54), and in the undo handling at process exit, where an
out-of-range undo entry is now skipped rather than panicking.

While here, use semvalid() instead of open-coding its implementation,
convert a couple of flags to bool, and use a better variable name to
store required permissions.

An unprivileged local user could trigger an out-of-bounds access on
kernel heap memory, potentially leading to privilege escalation.

Security:       CVE-2026-58098
Security:       FreeBSD-SA-26:64.sysvsem
Obtained from:  FreeBSD 04f841a05836
AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>
(cherry picked from commit 2390f4838a6b366992cbd0a04a1afb87c29a33b8)


  Commit: 84d4ba5ba97faf67372acb7007145028acb7ba59
      https://github.com/MidnightBSD/src/commit/84d4ba5ba97faf67372acb7007145028acb7ba59
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-01 (Thu, 01 Oct 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: sysvsem semop(2) fix (CVE-2026-58098)

AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>
(cherry picked from commit e1f1441cba8c9e03bb9d2bef1be38abc2569c4df)


Compare: https://github.com/MidnightBSD/src/compare/61a5153b2e86...84d4ba5ba97f

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications