{"id":181730,"date":"2026-05-25T20:48:13","date_gmt":"2026-05-25T18:48:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/7-novyh-uyazvimostej-v-freebsd"},"modified":"2026-05-25T20:48:13","modified_gmt":"2026-05-25T18:48:14","slug":"7-novyh-uyazvimostej-v-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/7-novyh-uyazvimostej-v-freebsd","title":{"rendered":"7 uut haavatavust FreeBSD-s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

20. mai 2026 kuulutas FreeBSD arendajatest seitsme uue haavatavuse parandamise. Mitte k\u00f5ik neist ei ole v\u00f5rdselt ohtlikud, kuid on ka \u00e4\u00e4rmiselt ebameeldivaid.
\n<\/p>\n

<\/p>\n

CVE-2026-45251<\/a> \u2014 use-after-free valdkonnas select-sarnastes s\u00fcsteemik\u00f5nedes, kui nende ootej\u00e4rjekorras on protsesside deskriptorid (FreeBSD 15-s on veel uued jail-deskriptorid), ja need deskriptorid on suletud teises l\u00f5imes, samal ajal kui oote-s\u00fcsteemik\u00f5ne oli endiselt ootel. Arvestades, et see commit<\/a>, on samuti m\u00f5jutatud deskriptorid, mis on seotud netmapiga (kiire otsene juurdep\u00e4\u00e4s v\u00f5rgu adapterile), kuid selle kohta pole ametlikku teavet. Protsessi deskriptorid ilmusid FreeBSD 9-s, nii et haavatavus on t\u00f5en\u00e4oliselt olemas olnud sellest ajast. Ametlikus avalduses \u00f6eldakse, et see haavatavus v\u00f5imaldab saada superkasutaja \u00f5igusi. Selle neutraliseerimise v\u00f5imalusi ilma patch'i\/v\u00e4rskendusteta pole.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45250<\/a> \u2014 vale vahemiku suuruse arvutamine ja sellele j\u00e4rgnev kirjutamine vahemikust m\u00f6\u00f6da stekis s\u00fcsteemik\u00f5nes setcred, kuigi setcred ise n\u00f5uab root-privileege, toimub stacki rikkumine enne privileegide kontrollimist ja seega on see k\u00f5igile kergesti ligip\u00e4\u00e4setav. See s\u00fcsteemik\u00f5ne ilmus FreeBSD 14.3-s (st varasemad versioonid ei ole m\u00f5jutatud) ja v\u00f5imaldab m\u00e4\u00e4rata k\u00f5ik kasutaja ja grupi identifikaatorid jooksva protsessi jaoks \u00fche k\u00f5ne kaudu, selle asemel et kasutada kombinatsioone setuid + setgid + setgroups jne. Vanus, mis lubab k\u00e4ituda pahatahtlikku koodi tuumakontekstis. V\u00e4lja on v\u00f5imalik neutraliseerida ilma plaastri\/uuenduseta.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45252<\/a> \u2014 l\u00f5ppnulli kontrolli puudumine enne stringi kopeerimist, mis saadakse fuse-demoonilt, uude vahemikku. Sellegipoolest on seal kontroll kopeerimise maksimaalse suuruse \u00fcle ja enam kui 253 lisabaiti tuumam\u00e4lust lugeda ei saa. Samuti on v\u00f5imalik kirjutada kuni 250 baiti «unallocated kernel heap space»-i. Vaikimisi on freebsdis keelatud mitte-root kasutajate poolt failis\u00fcsteemide mountimine, seega, et pahatahtliku fuse-demooni tuumale sisse panna, peab olema root. Kuid kui sysctl vfs.usermount=1 \u2014 siis muutub s\u00fcsteem haavatavaks ka tavakasutajatele. Samuti tuleb arvesse v\u00f5tta fuse-demooni ohtu jail-is, kus v\u00f5ib olla ka root (aga vaikimisi on see samuti keelatud).<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45253<\/a> \u2014 ptrace'i kasutamisel oli v\u00f5imalik k\u00e4ivitada seadistamata s\u00fcstemik\u00f5ne, mis viis tuumas koodi t\u00e4itmiseni, mida ei olnud ette n\u00e4htud s\u00fcsteemik\u00f5nena, millel v\u00f5ivad olla potentsiaalselt halvad tagaj\u00e4rjed. Kui security.bsd.unprivileged_proc_debug=0 (mis on igal juhul serverite jaoks hea praktika ning s\u00fcsteemi paigaldaja soovitab seda teha valikuliselt), siis ei suuda kasutaja- ja jail-protsessid kasutada ptrace'i ja seega j\u00e4\u00e4b haavatavus kergesti juurdep\u00e4\u00e4setavaks vaid rootile.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-45255<\/a> — shell-komanda s\u00fcstimeedide root-\u00f5igustega bsdinstall\/bsdconfig kaudu r\u00fcndavate traadita v\u00f5rkude nimede kaudu, mida seal ei olnud ekraanitud, nende loendit vaadates. Selle haavatavuse v\u00e4ltimiseks on piisav, et mitte vaadata traadita v\u00f5rkude loendit bsdinstall\/bsdconfig-st.<\/p>\n

<\/noindex><\/p>\n

CVE-2026-39461<\/a>, CVE-2026-45254<\/a> — haavatavused libcasper teegis (mitte kernelis). Teek on m\u00f5eldud protsesside turvaliseks kohandatavaks teenuste pakkumiseks karantiini. \u00dcks haavatavustest on seotud virna piiri\u00fcletamise ja virna riknemisega, mille p\u00f5hjustab selles teegis suure numbriga failide deskriptorite organiseerimine (see oli ette n\u00e4htud numbrite jaoks kuni 1024 — vaikimisi limiit select s\u00fcsteemik\u00f5nede struktuuride jaoks). Teine haavatavus — v\u00f5imalus eemaldada kehtestatud piirangute loendid (teegi ideoloogia seisneb selles, et kord kehtestatud piirangud protsessile v\u00f5ivad ainult suureneda) cap_net.<\/p>\n

<\/noindex><\/p>\n

Korrigeeritud versioonide s\u00fcsteemid on numbritega: 14.3-RELEASE-p14, 14.4-RELEASE-p5 ja 15.0-RELEASE-p9. Samuti on oluline m\u00e4rkida, et FreeBSD 13.5 versioon on hiljuti toe alt eemaldatud — 30. aprill 2026, ja selle jaoks (ja 13.x haru jaoks \u00fcldiselt) ametlikke parandusi enam ei ole. Kuid kui te mingil p\u00f5hjusel ei soovi veel \u00fcleminekuks kiirustada 14.x versioonile, sobivad 14.3 versiooni plaastrid \u00fcldiselt ka 13.5 l\u00e4htekoodile, ja CVE-2026-45250 13. haru jaoks on ebaoluline seoses setcred() puudumisega.<\/p>\n

<\/noindex><\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 FreeBSD \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0435\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041d\u0435 \u0432\u0441\u0435 \u043e\u043d\u0438 \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u043e \u043e\u043f\u0430\u0441\u043d\u044b, \u043d\u043e \u0435\u0441\u0442\u044c \u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435. CVE-2026-45251 — use-after-free \u0432 select-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0441\u0438\u0441\u043a\u043e\u043b\u043b\u0430\u0445, \u0435\u0441\u043b\u0438 \u0432 \u0438\u0445 \u0441\u043f\u0438\u0441\u043a\u0435 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0438\u043c\u0435\u044e\u0442\u0441\u044f \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 (\u0432 FreeBSD 15 — \u0435\u0449\u0451 \u043d\u043e\u0432\u044b\u0435 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b jail-\u043e\u0432), \u0438 \u044d\u0442\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u044b \u0431\u044b\u043b\u0438 \u0437\u0430\u043a\u0440\u044b\u0442\u044b \u0432 \u0434\u0440\u0443\u0433\u043e\u043c \u043f\u043e\u0442\u043e\u043a\u0435 \u043f\u043e\u043a\u0430 \u043e\u0436\u0438\u0434\u0430\u044e\u0449\u0438\u0439 \u0441\u0438\u0441\u043a\u043e\u043b\u043b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181730","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd477 uut haavatavust FreeBSD-s | ProHoster","description":"20. mai 2026 kuulutas FreeBSD arendajatest seitsme uue haavatavuse parandamise. Mitte k\u00f5ik neist ei ole v\u00f5rdselt ohtlikud, kuid on ka \u00e4\u00e4rmiselt ebameeldivaid.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/7-novyh-uyazvimostej-v-freebsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd477 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 FreeBSD | ProHoster","og:description":"20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 FreeBSD \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0435\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041d\u0435 \u0432\u0441\u0435 \u043e\u043d\u0438 \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u043e \u043e\u043f\u0430\u0441\u043d\u044b, \u043d\u043e \u0435\u0441\u0442\u044c \u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/7-novyh-uyazvimostej-v-freebsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-25T18:48:14+00:00","article:modified_time":"2026-05-25T18:48:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181730","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=181730"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181730\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=181730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=181730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=181730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}