A vulnerability (CVE-2026-7270) has been identified in FreeBSD that allows an unprivileged user to execute code with kernel privileges and gain root access to the system. The vulnerability affects all FreeBSD releases made since 2013. An exploit has been publicly released, which has been tested on systems from FreeBSD 11.0 to 14.4. The vulnerability has been fixed in updates FreeBSD 15.0-RELEASE-p7, 14.4-RELEASE-p3, 14.3-RELEASE-p12, and 13.5-RELEASE-p13. For older branches, a patch can be used.
The issue is caused by a buffer overflow in the execve system call that occurs when processing the prefix specified in the first line of scripts to determine the path to the interpreter (for example, "#! /bin/sh"). The overflow occurs during the execution of the memmove function due to an incorrect mathematical expression for calculating the size of the arguments to be copied into the buffer. Instead of subtracting the values of "args->begin_argv" and "consume" from "args->endp", only the value of "args->begin_argv" was subtracted from "args->endp", and the consume variable was added to the result instead of being subtracted, resulting in copying more data by two values of "consume". memmove(args->begin_argv + extend, args->begin_argv + consume, — args->endp — args->begin_argv + consume); + args->endp — (args->begin_argv + consume));
The overflow allows rewriting elements of the "exec_map" structure located in the adjacent memory area of another process. In the exploit, the overflow is used to overwrite the contents of "exec_map" of privileged processes that are periodically run in the system. The sshd process is chosen as such, which forks and execve's the process "/usr/libexec/sshd-session" with root privileges with each establishment of a network connection.
The exploit sets the environment variable "LD_PRELOAD=/tmp/evil.so" for this process, which leads to loading its library in the context of sshd-session. The injected library creates an executable file "/tmp/rootsh" with the suid root flag in the file system. The probability of successful overflow is estimated at 0.6%, but due to the cyclic repetition of attempts, successful exploitation is achieved in about 6 seconds on a system with a 4-core CPU.
Additionally, several other vulnerabilities have been fixed in FreeBSD:
- CVE-2026-35547, CVE-2026-39457 — buffer overflows in the libnv library, used in the kernel and in base system applications for processing key/value formatted lists and for organizing data transfer during inter-process communication. The first issue is caused by incorrect size calculation of the message when processing specially crafted IPC message headers. The second issue leads to stack overflow during data exchange over a socket due to lack of size matching between the socket descriptor and the buffer used in the select() function. These vulnerabilities can potentially be exploited to escalate privileges in the system.
- CVE-2026-42512 — remotely exploitable buffer overflow in dhclient, arising from improper size calculation of the array of pointers used to pass environment variables to dhclient-script. There is a possibility of creating an exploit for remote code execution by sending a specially crafted DHCP packet.
- CVE-2026-7164 — stack overflow in the pf packet filter, occurring when processing specially crafted SCTP packets. The issue is caused by unbounded recursive parsing of SCTP parameters.
- CVE-2026-42511 — arbitrary directive substitution in dhclient.conf due to lack of proper escaping of double brackets in BOOTP fields received from an external DHCP server. During subsequent parsing of this file by the dhclient process, the specified attacker-controlled field is passed to dhclient-script, which can be utilized to execute arbitrary commands with root privileges on systems using dhclient when contacting a malicious DHCP server.
- CVE-2026-6386 — insufficient handling of large memory pages in the pmap_pkru_update_range() kernel function. An unprivileged user can make pmap_pkru_update_range() treat memory from user space as a page in the memory table and achieve overwriting of a memory area to which access is restricted.
- CVE-2026-5398 — access to an already freed memory area in the TIOCNOTTY handler, allowing an unprivileged process to gain root rights.
Source: opennet.ru
