diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-08-24 18:15:38 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-08-24 21:51:23 +0000 |
| commit | cec488c1669b78039660016980e25a5a193b3e65 (patch) | |
| tree | 2a60addceff7f6e28210a5673f91601f847908bf /sys/modules/netgraph/socket | |
| parent | 45a190c827e4b3b57b8c9799731cb1baf5554e04 (diff) | |
posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
The check for whether shm_lp_psind was assigned was unlocked. This race
can be exploited to create an object with psind==2 but with only
pagesizes[1] worth of pages populated. This in turn can be used to
escalate privileges.
Fix this by acquiring the rangelock earlier. In shm_mmap_large(),
assert that we hold the rangelock. In shm_write(), annotate an unlocked
load of shm_lp_psind.
Approved by: so
Security: FreeBSD-SA-26:63.posixshm
Security: CVE-2026-58094
Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59104
Diffstat (limited to 'sys/modules/netgraph/socket')
0 files changed, 0 insertions, 0 deletions