In FreeBSD, a vulnerability (CVE-2026-4747) has been fixed, which allows for code execution at the kernel level through the sending of network packets to an NFS server. The issue arises when using the kgssapi.ko module, which implements the RPCSEC_GSS API on the kernel side. In addition to the kernel, the vulnerability also affects applications in user space that utilize the librpcgss_sec library and perform functions of an RPC server. Such applications, which do not belong to the core FreeBSD system, could also be attacked via the sending of network packets.
The problem exists in the implementation of the GSS (Generic Security Services) API, which facilitates the establishment of secure authenticated communication channels with server. RPCSEC_GSS is used in NFS servers to protect access to Sun RPC using Kerberos-based authentication and encryption of traffic between the server and the client. The issue is caused due to the fact that during the signature verification, data from the packet is copied into a fixed buffer without appropriate size checks. The error occurs before authentication is completed, but requires the ability to send network packets to the NFS server. An exploit is available that allows the remote execution of /bin/sh with root privileges.
The vulnerability was identified by an employee of Anthropic using the AI assistant Claude. Notably, outside researchers from the Calif team utilized Claude to write a working exploit by providing only the publicly available report issued by FreeBSD about the vulnerability. In addition to the direct exploitation of the vulnerability, the AI model deployed a virtual machine with a vulnerable configuration, set up remote debugging and reading of kernel crash dumps, and organized the launch of /bin/sh in the exploit after achieving code execution at the kernel level. The creation of the exploit took 4 hours of the Claude model's processing time.
The researchers who created the exploit didn't stop there and continued their experiments using Claude to identify vulnerabilities in Vim and Emacs that allow for code execution when opening specially crafted files in the editors. Notably, the prompts given to the model amounted to a simple task, such as 'find a 0-day vulnerability in Vim that arises when opening a file'. As a result, Claude successfully discovered previously unknown vulnerabilities.
The vulnerability in Vim (CVE-2026-34714) is caused by an error when processing the tabpanel option in the default modeline mode (':set modeline'), which allows for the determination of editing options in the processed file. According to the Vim developers' intent, only a limited number of options may be set through the modeline, with expressions executed within a sandbox that only permits the use of the simplest safe operations.
The tabpanel option did not have the P_MLE flag set, which allowed for the use of the %{expr} expression, executed without activating the modelineexpr mode. To bypass the sandbox isolation, a flaw in the autocmd_add() function was exploited, which lacked proper security checks when binding an action to the SafeStateAgain event, allowing the execution of a command after exiting the sandbox isolation. The vulnerability has been addressed in the Vim v9.2.0272 release. An example line that leads to the execution of the 'id' utility and directs the output to the file '/tmp/calif-vim-rce-poc': /* vim: set showtabpanel=2 tabpanel=%{%autocmd_add([{‘event’\:’SafeStateAgain’,’pattern’\:’*’,’cmd’\:’!id>/tmp/calif-vim-rce-poc’,’once’\:1}])%}: */
The vulnerability in Emacs is caused by the automatic processing of the contents of the .git/ directory when it is located in the same directory as the file being opened. In this case, Emacs runs the commands 'git ls-files' and 'git status' when opening the file, executed in the context of the contents of '.git/'. To achieve code execution, it is sufficient to open a file in Emacs from a directory that contains a .git/ subdirectory with a configuration file 'config' including the attacker's command option to execute. The accompanying GNU Emacs team refused to fix the vulnerability, stating that the problem lies within Git.
Additionally, two more vulnerabilities can be noted:
- CVE-2026-33150 — a use-after-free memory access in the io_uring handler from the libfuse library, potentially allowing for code execution during resource exhaustion while working with file systems implemented via FUSE (Filesystem in Userspace).
- CVE-2026-34743 — overflow del buffer nell'implementazione della funzione lzma_index_append() della libreria liblzma. Il problema si manifesta quando si utilizza la funzione lzma_index_decoder() per decodificare un indice che non contiene record, comportando l'allocazione di un buffer più piccolo del necessario. Si segnala che l'API di basso livello lzma_index* è utilizzata raramente nelle applicazioni e che è poco probabile trovare applicazioni in cui si verifichino le condizioni necessarie per l'esploitazione del problema con l'indice. La vulnerabilità è stata risolta nell'aggiornamento XZ Utils 5.8.3.
Fonte: opennet.ru
