At the 39C3 conference (Chaos Communication Congress), a report was presented with the results of research on the security of the FreeBSD jail mechanism. The authors of the study managed to escape the Jail and compromise the host, provided that the attacker has root privileges inside the Jail. Code for five exploit prototypes, utilizing vulnerabilities in ipfilter, dummynet, carp, and ipfw that manifest in FreeBSD 14.3-RELEASE, has been published on GitHub. A total of about 50 security issues in the FreeBSD kernel were identified during the research, for some of which patches have been prepared.
Main findings at the end of the report:
- Modern operating systems are extremely complex, and the emergence of bugs in them is inevitable.
- Most of the analyzed code was written in the 1990s and has not been audited in a long time.
- Most of the identified vulnerabilities are related to low-level memory management errors that could have been avoided by using modern languages, such as Rust.
Source: opennet.ru
