Two vulnerabilities have been identified in the FreeBSD project's jail isolated environment system:
- CVE-2020-25582 — a vulnerability in the implementation of the jail_attach system call designed to attach external processes to existing jail environments. The issue arises when calling jail_attach using the jexec or killall commands, allowing a privileged process isolated within the jail to change its root directory and gain full access to all files and directories in the system.
- CVE-2020-25581 — a race condition when removing processes using the jail_remove system call, allowing a privileged process running inside the jail to avoid removal upon jail termination and gain full access to the system through devfs when the jail is restarted with the same root directory, leveraging the moment when devfs is already mounted for the jail but isolation rules have not yet been applied.
Additionally, a vulnerability (CVE-2020-25580) is noted in the PAM module pam_login_access, responsible for handling the login_access file, which defines user and group access rules applied during system login (by default, login is allowed through console, sshd, and telnetd). This vulnerability allows users to bypass login_access restrictions and log in despite the existence of denying rules.
The vulnerabilities have been fixed in the 13.0-STABLE, 12.2-STABLE, and 11.4-STABLE branches, as well as in the corrective updates FreeBSD 12.2-RELEASE-p4 and 11.4-RELEASE-p8.
Source: opennet.ru
