A FreeBSD project-developed system of isolated environments (jail) has identified two vulnerabilities:
- CVE-2020-25582 — vulnerability in the implementation of the jail_attach system call, designed to attach external processes to existing jail environments. The issue manifests during the call to jail_attach using jexec or killall commands, allowing a privileged process isolated within the jail to change its root directory and gain full access to all files and directories in the system.
- CVE-2020-25581 — a race condition during the removal of processes via the jail_remove system call, allowing a privileged process running inside the jail to avoid deletion upon the jail's termination and gain full access to the system through devfs when subsequently restarting the jail with the same root directory, taking advantage of the moment when devfs is already mounted for the jail, but isolation rules have not yet been applied.
Additionally, we can note the vulnerability (CVE-2020-25580) in the PAM module pam_login_access, responsible for processing the login_access file, which defines user and group access rules applied during system login (by default, access is allowed via console, sshd, and telnetd). This vulnerability allows bypassing the login_access restrictions and logging in despite the presence of prohibitive rules.
The vulnerabilities have been addressed in the 13.0-STABLE, 12.2-STABLE, and 11.4-STABLE branches, as well as in corrective updates FreeBSD 12.2-RELEASE-p4 and 11.4-RELEASE-p8.
Forrás: opennet.ru
