{"id":170544,"date":"2026-05-09T12:24:31","date_gmt":"2026-05-09T10:24:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd"},"modified":"2026-05-09T12:24:31","modified_gmt":"2026-05-09T10:24:32","slug":"uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd","title":{"rendered":"S\u00e5rbarhed i systemopkaldet execve, der giver root-adgang i FreeBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Der er opdaget en s\u00e5rbarhed i FreeBSD (CVE-2026-7270), der tillader en ikke-privilegeret bruger at udf\u00f8re kode med kernel-rettigheder og f\u00e5 root-adgang til systemet. S\u00e5rbarheden p\u00e5virker alle versioner af FreeBSD, der er udgivet siden 2013. En exploit er offentligt tilg\u00e6ngelig, og dens funktionalitet er blevet testet p\u00e5 systemer med FreeBSD 11.0 til 14.4. S\u00e5rbarheden er blevet rettet i opdateringerne FreeBSD 15.0-RELEASE-p7, 14.4-RELEASE-p3, 14.3-RELEASE-p12 og 13.5-RELEASE-p13. For \u00e6ldre versioner kan der anvendes et patch. <\/p>\n
Problemet skyldes et buffer overflow i systemkaldet execve, som opst\u00e5r ved behandling af pr\u00e6fikset angivet i den f\u00f8rste linje af scripts til at bestemme stien til fortolkeren (for eksempel #!\/bin\/sh). Overflowet opst\u00e5r ved kald af funktionen memmove p\u00e5 grund af en forkert sammens\u00e6tning af det matematiske udtryk til beregning af st\u00f8rrelsen p\u00e5 de argumenter, der kopieres til bufferet. I stedet for at tr\u00e6kke v\u00e6rdierne args->begin_argv og consume fra args->endp, blev kun v\u00e6rdien args->begin_argv trukket fra args->endp, mens variablen consume blev lagt til resultatet i stedet for at blive trukket fra, hvilket resulterede i, at der blev kopieret mere data med to v\u00e6rdier af consume. memmove(args->begin_argv + extend, args->begin_argv + consume, \u2014 args->endp \u2014 args->begin_argv + consume); + args->endp \u2014 (args->begin_argv + consume)); <\/p>\n
Overflowet muligg\u00f8r overskrivning af elementer i strukturen exec_map, der er placeret i et n\u00e6rliggende hukommelsesomr\u00e5de fra en anden proces. I exploit'et bruges overflowet til at overskrive indholdet af exec_map fra privilegerede processer, der bliver k\u00f8rt sporadisk i systemet. Som en s\u00e5dan proces v\u00e6lges sshd, som ved hver oprettelse af en netv\u00e6rksforbindelse afspalter via kaldet fork og execve processen \/usr\/libexec\/sshd-session med root-rettigheder. <\/p>\n
Exploit'et inds\u00e6tter for denne proces en milj\u00f8variabel LD_PRELOAD=\/tmp\/evil.so, hvilket medf\u00f8rer, at dens bibliotek indl\u00e6ses i konteksten af sshd-session. Det indsatte bibliotek skaber en eksekverbar fil \/tmp\/rootsh i filsystemet med suid root-flaget. Sandsynligheden for et vellykket overflow vurderes til 0,6%, men takket v\u00e6re cyklisk gentagelse af fors\u00f8g opn\u00e5s en succesfuld udnyttelse p\u00e5 cirka 6 sekunder p\u00e5 en maskine med en 4-kerne CPU.
<\/center> <\/p>\n
Derudover er der blevet rettet flere andre s\u00e5rbarheder i FreeBSD: <\/p>\n
\n
CVE-2026-35547, CVE-2026-39457 \u2014 buffer overflows in the libnv library used in the kernel and in applications from the base system for processing key\/value list formats and organizing data transfer in inter-process communication. The first issue is caused by incorrect message size calculations when handling specially crafted IPC message headers. The second issue leads to a stack overflow during data exchange over a socket due to a lack of size checking between the socket descriptor and the buffer size used in the select() function. These vulnerabilities could potentially be exploited for privilege escalation in the system.\n
CVE-2026-42512 \u2014 remotely exploitable buffer overflow in dhclient, arising from incorrect array size calculations for pointers used to pass environment variables in dhclient-script. There is a possibility of creating an exploit for remote code execution by sending specially crafted DHCP packets.\n
CVE-2026-7164 \u2014 stack overflow in the pf packet filter, occurring when processing specially crafted SCTP packets. The issue is caused by unlimited recursive parsing of SCTP parameters.\n
CVE-2026-42511 \u2014 the possibility of injecting arbitrary directives into dhclient.conf due to insufficient escaping of double brackets in BOOTP fields received from an external DHCP server. When this file is subsequently parsed by the dhclient process, the field specified by the attacker is passed to dhclient-script, which can be used to execute arbitrary commands with root privileges on systems using dhclient when communicating with an attacker's controlled DHCP server.\n
CVE-2026-6386 \u2014 inadequate handling of large memory pages in the kernel function pmap_pkru_update_range(). An unprivileged user can force pmap_pkru_update_range() to handle memory from user space as a page in the memory page table, achieving the rewriting of a memory area that should not be accessible.\n
CVE-2026-5398 \u2014 access to already freed memory in the TIOCNOTTY handler, allowing an unprivileged process to gain root privileges. <\/ul>\n
![\"S\u00e5rbarhed](\"\/wp-content\/uploads\/2026\/05\/6d8779e37e52d9af205b881f8e8a065c.png\")
<\/center> <\/p>\n