{"id":182528,"date":"2026-07-08T04:53:20","date_gmt":"2026-07-08T02:53:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-vo-freebsd-dopuskayushhie-povyshenie-privilegij-i-udalyonnoe-vypolnenie-koda"},"modified":"2026-07-08T04:53:20","modified_gmt":"2026-07-08T02:53:20","slug":"uyazvimosti-vo-freebsd-dopuskayushhie-povyshenie-privilegij-i-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-vo-freebsd-dopuskayushhie-povyshenie-privilegij-i-udalyonnoe-vypolnenie-koda","title":{"rendered":"Vulnerabilities in FreeBSD allow privilege escalation and remote code execution.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
FreeBSD has fixed 22 vulnerabilities, one of which potentially allows for remote code execution with root privileges, while 13 can be exploited to elevate privileges within the system. The vulnerabilities are addressed in updates FreeBSD 15.1-RELEASE-p1, FreeBSD 15.0-RELEASE-p11, 14.4-RELEASE-p7, and 14.3-RELEASE-p16. <\/p>\n
The most dangerous vulnerability (CVE-2026-49420) is caused by a buffer overflow in the libalias library, used in the kernel-level ipfw packet filter and in the user-space background process natd for address translation of sent or received network packets. The overflow occurred in the RTSP (Real Time Streaming Protocol) handler, which overwrote outgoing network packets using a fixed-size buffer without checking whether the result of the packet overwriting would fit into it. <\/p>\n
During the processing of specially crafted RTSP traffic at the NAT gateway, a stack overflow may occur, potentially leading to remote code execution at the kernel level or in the natd process running in the system with root privileges. <\/p>\n
As workarounds to block the vulnerability, one can block the loading of the alias_smedia.ko kernel module and remove the mention of the libalias_smedia.so handler from the configuration file \/etc\/libalias.conf. If RTSP protocol is not used, traffic on network ports 554 and 7070 can be blocked in the rules specified before NAT rules are triggered. <\/p>\n
Vulnerabilities that allow a non-privileged local user to gain root privileges: <\/p>\n
\n
CVE-2026-49415 \u2014 a race condition in the execve system call that allows a local user executing SUID root binaries to modify the process's address space through procfs or linprocfs in a small time window occurring after setting up a new process virtual address space but before updating its ownership data.\n
CVE-2026-49422 \u2014 use-after-free memory access in the tcp_rack.ko kernel module, which implements the RACK (Recent ACKnowledgment) TCP packet loss detection algorithm. This vulnerability can be exploited for privilege escalation through manipulation of a local socket.\n
CVE-2026-49419 \u2014 underflow in the reference count management mechanism of the Jail isolation. By manipulating jail environments using jail descriptors with the jail_set and jail_get functions, an attacker could reset the reference count and free memory for a structure still in use by the kernel, potentially exploitable for privilege escalation.\n
CVE-2026-49429 \u2014 buffer overflow in OpenZFS, allowing a local user with ZFS 'userused' rights to escalate privileges through manipulation of ioctl ZFS_IOC_USERSPACE_MANY.\n
CVE-2026-49427, CVE-2026-49428 \u2014 vulnerabilities in the implementation of 'largepage' shared memory objects that lead to use-after-free memory access in the kernel, which can be exploited for privilege escalation through manipulation of the sendfile function with the SF_NOCACHE flag or the open and fspacectl functions with the O_TRUNC flag.\n
CVE-2026-49421 \u2014 improper handling of the AT_RESOLVE_BENEATH flag in the unlinkat and funlinkat system calls may be used to delete files outside the base directory in configurations with restricted file system access.\n
CVE-2026-49418 \u2014 accessing memory after it has been freed in the virtual memory subsystem, occurring during a call to the msync(MS_INVALIDATE) function for device memory mapping. An attacker with access to a device supporting memory mapping may exploit this vulnerability for privilege escalation.\n
CVE-2026-49416 \u2014 integer overflow in the vt console driver, allowing a local user potentially to escalate privileges by sending an ioctl CONS_HISTORY with an excessively large size.\n
CVE-2026-49413 \u2014 a vulnerability in Linuxulator that allows an unprivileged user to substitute their shared library via the LD_PRELOAD environment variable in an executable file with the suid flag and execute their code with the privileges of that executable.\n
CVE-2026-49412 \u2014 accessing already freed memory in the IPV6_MSFILTER option handler in sockets, allowing privilege escalation.\n
CVE-2026-45258 \u2014 issues with the implementation of memory mapping (mmap) support in the sound driver, allowing data to be read and written in kernel memory regions through manipulations with the \/dev\/dsp device, which is by default writable by everyone.\n
CVE-2026-45257 \u2014 a vulnerability in the ktls kernel module that allows overwriting any file accessible for reading in the page cache by an attacker. By overwriting a suid root file like \/bin\/su, the attacker can gain root privileges on the system. <\/ul>\n
Less critical vulnerabilities: <\/p>\n
\n
CVE-2026-49430, CVE-2026-49431 \u2014 vulnerabilities in OpenZFS that lead to kernel memory corruption and the ability to set the $hasrecvd flag without the necessary permissions.\n
CVE-2026-49426 \u2014 incorrect creation of audit records for ptrace calls. Can be exploited by an attacker to bypass intrusion detection systems.\n
CVE-2026-49423 \u2014 a remote DoS vulnerability in the KTLS kernel subsystem, exploited by sending specially crafted TLS packets. The issue occurs only on systems using KTLS for accelerated TLS processing (kern.ipc.tls.enable=1).\n
CVE-2026-49424 \u2014 a leak of 104 bytes from an uninitialized kernel stack in the implementation of the waitid() system call in Linuxulator.\n
CVE-2026-49425 \u2014 data leak from an uninitialized kernel stack in the compat32 subsystem.\n
CVE-2026-58081, CVE-2026-58082 \u2014 buffer overflows in the iconv library that can be used to attack applications using iconv to convert untrusted external data in the HZ, UTF-7, VIQR, ZW, and ISO-2022 encodings. <\/ul>\n