{"id":181730,"date":"2026-05-25T20:48:13","date_gmt":"2026-05-25T18:48:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/7-novyh-uyazvimostej-v-freebsd"},"modified":"2026-05-25T20:48:13","modified_gmt":"2026-05-25T18:48:14","slug":"7-novyh-uyazvimostej-v-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/7-novyh-uyazvimostej-v-freebsd","title":{"rendered":"7 uut haavatavust FreeBSD-s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

20. mai 2026 kuulutas FreeBSD arendajad v\u00e4lja seitsme uue haavatavuse paranduse. Need ei ole k\u00f5ik v\u00f5rdselt ohtlikud, kuid m\u00f5ned neist on ka \u00e4\u00e4rmiselt ebameeldivad.
\n<\/p>\n

<\/p>\n

CVE-2026-45251<\/a> — use-after-free select-taoliste sisskolles, kui nende ootej\u00e4rjekorras on protsessi deskriptorid (FreeBSD 15 — ka uued jail-deskriptorid), ning need deskriptorid on suletud teises l\u00f5imes, samal ajal kui ootav sisskool on ikka veel ootele j\u00e4\u00e4nud. Kohtuotsuse kohaselt sellest commit'ist<\/a>, on seotud ka netmap'i (kiire otsejuurdep\u00e4\u00e4su v\u00f5rkaarturi draiver) deskriptorid, kuid selle kohta pole ametlikku teavet. Protsesside deskriptorid ilmusid FreeBSD 9-s, seega on haavatavus t\u00f5en\u00e4oliselt kestnud alates sellest ajast. Ametlikus avalduses on \u00f6eldud, et haavatavus v\u00f5imaldab saada superkasutaja \u00f5igusi. Selle neutraliseerimise v\u00f5imalust ilma plaastri\/uuenduseta ei ole.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45250<\/a> — vale puhvri suuruse arvutamine ja sellele j\u00e4rgnev kirjutamine puhvri \u00e4\u00e4rest kaugemale setcred s\u00fcsteemikutses, kusjuures kuigi setcred n\u00f5uab ise root-i \u00f5igusi, toimub puhvri rikkumine enne \u00f5iguste kontrollimist ja seega on see k\u00e4tte saadav k\u00f5igile. See s\u00fcsteemikutsumine ilmus FreeBSD 14.3-s (st varasemad versioonid pole m\u00f5jutatud) ja pakub v\u00f5imalust seadistada kogu praeguse protsessi kasutaja ja grupi identifikaatorid \u00fche kutsumisega, selle asemel et kasutada setuid+setgid+setgroups ja sarnaseid kombinatsioone. Haavatavus v\u00f5imaldab pahatahtlikul koodil t\u00f6\u00f6tada tuuma kontekstis. Selle neutraliseerimiseks pole v\u00f5imalust ilma patchita\/v\u00e4rskenduseta.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45252<\/a> — l\u00f5pliku nulli olemasolu kontrollimise puudumine vana stringi kopeerimisel, mis saadud fuse-deemonilt, uude puhvrit. Siiski on seal kontroll maksimumsuuruse kopeerimise osas, ning rohkem kui 253 \u00fcleliigset baiti tuuma m\u00e4lust lugeda ei saa. Samuti on v\u00f5imalik kirjutada kuni 250 baiti «unallocated kernel heap space» . FreeBS-d keelab vaikimisi mitte-root kasutajatel failis\u00fcsteemide mountimise, seega peab tuuma pahatahtliku fuse-deemoni alla surumiseks olema root. Kuid kui sysctl vfs.usermount=1 — s\u00fcsteem muutub haavatavaks ka tavakasutajatele. Samuti tuleb arvesse v\u00f5tta fuse-deemoni oht jail-is, kus see v\u00f5ib olla ka root (kuid vaikimisi on see ka keelatud).<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45253<\/a> — ptrace'i kasutamisel oli v\u00f5imalik k\u00e4ivitada s\u00fcsteemikutses, mille number oli vale, mis t\u00f5i kaasa koodi t\u00e4itmise tuumas, mis ei olnud ette n\u00e4htud s\u00fcsteemikutsena ja millel olid potentsiaalselt halvad tagaj\u00e4rjed. Kui security.bsd.unprivileged_proc_debug=0 (mis on igal juhul serverite jaoks hea praktika ja s\u00fcsteemi installija pakub isegi v\u00f5imalust seda teha), siis ei saa kasutaja- ja jailed-protsessid ptrace'i kasutada ning seega j\u00e4\u00e4b haavatavus k\u00e4tte saadavaks ainult rootile.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45255<\/a> — shell-k\u00e4skude s\u00fcstimine root-\u00f5igustega bsdinstall\/bsdconfig kaudu pahatahtlike traadita v\u00f5rgu nimede kaudu, mida seal ei eskineeritud vaatamise hetkel. Selle haavatavuse v\u00e4ltimiseks piisab, kui mitte vaadata bsdinstall\/bsdconfig-st traadita v\u00f5rkude loendit.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-39461<\/a>, CVE-2026-45254<\/a> — haavatavused teegis libcasper (mitte tuumas). Teek on m\u00f5eldud ohutuks, kohandatavaks teenuste pakkumiseks protsessidele, mis on liivakasti paigutatud. \u00dcks haavatavus on seotud puhvri piiri \u00fcletimisega ja puhvri kahjustamisega, tekitades selles teegis suurte numbritega failideskriptorid (see oli arvutatud kuni 1024 — sisskooli selecti vaikimisi struktuuride piir). Teine haavatavus on v\u00f5imalus eemaldada piiranguid, mis on kehtestatud (teegi ideoloogia on see, et kord kehtestatud piiranguid saab ainult suurendada) cap_net.<\/p>\n

<\/noindex><\/p>\n

Parandatud versioonide s\u00fcsteemid on numbritega: 14.3-RELEASE-p14, 14.4-RELEASE-p5 ja 15.0-RELEASE-p9. Tuleb m\u00e4rkida ka m\u00f5ningast olulist punkti: FreeBSD 13.5 versioon on hiljuti toeta t\u00f5mmatud — 30. aprill 2026, ja selle jaoks (ja 13.x haru jaoks \u00fcldiselt) pole ametlikke parandusi enam. Siiski, kui te mingil p\u00f5hjusel ei kiirusta versioonile 14.x \u00fcleminekul, sobivad 14.3 patchid suuresti ka 13.5 allikakoodile, ja CVE-2026-45250 13. haru jaoks pole asjakohane, kuna selles ei ole setcred().<\/p>\n

<\/noindex><\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 FreeBSD \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0435\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041d\u0435 \u0432\u0441\u0435 \u043e\u043d\u0438 \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u043e \u043e\u043f\u0430\u0441\u043d\u044b, \u043d\u043e \u0435\u0441\u0442\u044c \u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435. CVE-2026-45251 — use-after-free \u0432 select-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0441\u0438\u0441\u043a\u043e\u043b\u043b\u0430\u0445, \u0435\u0441\u043b\u0438 \u0432 \u0438\u0445 \u0441\u043f\u0438\u0441\u043a\u0435 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0438\u043c\u0435\u044e\u0442\u0441\u044f \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 (\u0432 FreeBSD 15 — \u0435\u0449\u0451 \u043d\u043e\u0432\u044b\u0435 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b jail-\u043e\u0432), \u0438 \u044d\u0442\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b \u0431\u044b\u043b\u0438 \u0437\u0430\u043a\u0440\u044b\u0442\u044b \u0432 \u0434\u0440\u0443\u0433\u043e\u043c \u043f\u043e\u0442\u043e\u043a\u0435 \u043f\u043e\u043a\u0430 \u043e\u0436\u0438\u0434\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u043a\u043e\u043b\u043b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181730","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd477 uut haavatavust FreeBSD | ProHoster","description":"20. mai 2026. aastal teatasid FreeBSD arendajad seitsme uue haavatavuse parandamisest s\u00fcsteemis. Mitte k\u00f5ik neist ei ole v\u00f5rdselt ohtlikud, kuid m\u00f5ned on \u00e4\u00e4rmiselt ebameeldivad. CVE-2026-45251 \u2014 use-after-free select-sarnastes s\u00fcsteemikutsungites, kui nende ootej\u00e4rjekorras on protsesside deskriptorid (FreeBSD 15-s uued jail-deskriptorid) ning need deskriptorid suleti teises l\u00f5imes samal ajal, kui ootel oli s\u00fcsteemikutsung.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/7-novyh-uyazvimostej-v-freebsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd477 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 FreeBSD | ProHoster","og:description":"20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 FreeBSD \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0435\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041d\u0435 \u0432\u0441\u0435 \u043e\u043d\u0438 \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u043e \u043e\u043f\u0430\u0441\u043d\u044b, \u043d\u043e \u0435\u0441\u0442\u044c \u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435. CVE-2026-45251 \u2014 use-after-free \u0432 select-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0441\u0438\u0441\u043a\u043e\u043b\u043b\u0430\u0445, \u0435\u0441\u043b\u0438 \u0432 \u0438\u0445 \u0441\u043f\u0438\u0441\u043a\u0435 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0438\u043c\u0435\u044e\u0442\u0441\u044f \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 (\u0432 FreeBSD 15 \u2014 \u0435\u0449\u0451 \u043d\u043e\u0432\u044b\u0435 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b jail-\u043e\u0432), \u0438 \u044d\u0442\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b \u0431\u044b\u043b\u0438 \u0437\u0430\u043a\u0440\u044b\u0442\u044b \u0432 \u0434\u0440\u0443\u0433\u043e\u043c \u043f\u043e\u0442\u043e\u043a\u0435 \u043f\u043e\u043a\u0430 \u043e\u0436\u0438\u0434\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u043a\u043e\u043b\u043b","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/7-novyh-uyazvimostej-v-freebsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-25T18:48:14+00:00","article:modified_time":"2026-05-25T18:48:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181730","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=181730"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181730\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=181730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=181730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=181730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}