{"id":170544,"date":"2026-05-09T12:24:31","date_gmt":"2026-05-09T10:24:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd"},"modified":"2026-05-09T12:24:31","modified_gmt":"2026-05-09T10:24:32","slug":"uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd","title":{"rendered":"A vulnerability in the execve system call that provides root access in FreeBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2026-7270) has been identified in FreeBSD that allows an unprivileged user to execute code with kernel privileges and gain root access to the system. The vulnerability affects all FreeBSD releases made since 2013. An exploit has been publicly released, which has been tested on systems from FreeBSD 11.0 to 14.4. The vulnerability has been fixed in updates FreeBSD 15.0-RELEASE-p7, 14.4-RELEASE-p3, 14.3-RELEASE-p12, and 13.5-RELEASE-p13. For older branches, a patch can be used. <\/p>\n
The issue is caused by a buffer overflow in the execve system call, which occurs when processing the prefix specified in the first line of scripts to determine the path to the interpreter (for example, #!\/bin\/sh). The overflow happens during the call to the memmove function due to an incorrect mathematical expression used to calculate the size of the arguments being copied into the buffer. Instead of subtracting the value of args->begin_argv from args->endp and consume, only the value of args->begin_argv was subtracted from args->endp, while the variable consume was added to the result instead of being subtracted, meaning that more data was copied by two consume values. \tmemmove(args->begin_argv + extend, args->begin_argv + consume, —\t args->endp — args->begin_argv + consume); +\t args->endp — (args->begin_argv + consume)); <\/p>\n
The overflow allows overwriting elements of the exec_map structure stored in a neighboring memory area from another process. The exploit utilizes the overflow to overwrite the contents of exec_map of privileged processes that are periodically executed in the system. The sshd process is chosen as a similar process, which, upon each establishment of a network connection, forks and execve the process \/usr\/libexec\/sshd-session with root privileges. <\/p>\n
The exploit injects the environment variable LD_PRELOAD=\/tmp\/evil.so for this process, leading to the loading of its library in the context of sshd-session. The injected library creates an executable file \/tmp\/rootsh with the suid root flag on the filesystem. The probability of a successful overflow is estimated at 0.6%, but due to the cyclic repetition of attempts, successful exploitation is achieved in approximately 6 seconds on a system with a 4-core CPU.
<\/center> <\/p>\n
Additionally, several other vulnerabilities have been fixed in FreeBSD: <\/p>\n
\n
CVE-2026-35547, CVE-2026-39457 \u2014 buffer overflows in the libnv library used in the kernel and core system applications for processing key\/value formatted lists and managing data transfer during inter-process communication. The first issue is caused by incorrect message size calculation when handling specially formatted IPC message headers. The second issue leads to stack overflow during data exchange over a socket due to a lack of size consistency check between the socket descriptor and the buffer size used in the select() function. These vulnerabilities could potentially be exploited to elevate privileges in the system.\n
CVE-2026-42512 \u2014 remotely exploitable buffer overflow in dhclient, arising from incorrect size calculation of the pointer array used to pass environment variables to the dhclient-script. There is a possibility of creating an exploit for remote code execution by sending a specially crafted DHCP packet.\n
CVE-2026-7164 \u2014 stack overflow in the pf packet filter, occurring when processing specially crafted SCTP packets. The issue is caused by limitless recursive parsing of SCTP parameters.\n
CVE-2026-42511 \u2014 potential for arbitrary directive substitution in dhclient.conf due to a lack of proper escaping of double brackets in BOOTP fields obtained from an external DHCP server. During subsequent parsing of this file by the dhclient process, the field specified by the attacker is passed to the dhclient-script, which can be used to execute arbitrary commands with root privileges on systems using dhclient when connecting to an attacker-controlled DHCP server.\n
CVE-2026-6386 \u2014 insufficient handling of large memory pages in the kernel function pmap_pkru_update_range(). A non-privileged user can coerce pmap_pkru_update_range() into treating user space memory as a page in the memory page table, leading to the overwriting of a memory area that is not accessible.\n
CVE-2026-5398 \u2014 accessing already freed memory in the TIOCNOTTY handler, allowing a non-privileged process to gain root privileges. <\/ul>\n
![\"A](\"\/wp-content\/uploads\/2026\/05\/6d8779e37e52d9af205b881f8e8a065c.png\")
<\/center> <\/p>\n