diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-08-24 18:14:18 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-08-24 21:51:22 +0000 |
| commit | 45a190c827e4b3b57b8c9799731cb1baf5554e04 (patch) | |
| tree | 655a6c89c89fdd217db6e43fd7b68ee693004962 /sys/modules/wlan | |
| parent | ae2c9e5bba0a484885bd1140fb67836c29eb2a4b (diff) | |
tty: Revalidate after dropping the tty lock in ioctl handlers
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the
proctree relock. After relocking the tty, it did not revalidate the
tty state, and it could end up linking a doomed tty to the calling
process' session. This race can be exploited to escalate privileges.
TIOCSPGRP has a similar race, fix that too.
Approved by: so
Security: FreeBSD-SA-26:62.tty
Security: CVE-2026-58093
Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59126
Diffstat (limited to 'sys/modules/wlan')
0 files changed, 0 insertions, 0 deletions