{"id":170544,"date":"2026-05-09T12:24:31","date_gmt":"2026-05-09T10:24:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd"},"modified":"2026-05-09T12:24:31","modified_gmt":"2026-05-09T10:24:32","slug":"uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd","title":{"rendered":"Vulnerabilitate \u00een apelul de sistem execve, oferind acces root \u00een FreeBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A fost descoperit\u0103 o vulnerabilitate \u00een FreeBSD (CVE-2026-7270) care permite unui utilizator neprivilegiat s\u0103 execute cod cu drepturi de kernel \u0219i s\u0103 ob\u021bin\u0103 acces root la sistem. Vulnerabilitatea afecteaz\u0103 toate versiunile FreeBSD lansate din 2013. Un exploit a fost publicat, a c\u0103rui func\u021bionare a fost verificat\u0103 pe sistemele cu FreeBSD 11.0 p\u00e2n\u0103 la 14.4. Vulnerabilitatea a fost remediat\u0103 \u00een actualiz\u0103rile FreeBSD 15.0-RELEASE-p7, 14.4-RELEASE-p3, 14.3-RELEASE-p12 \u0219i 13.5-RELEASE-p13. Pentru versiuni mai vechi, se poate utiliza un patch. <\/p>\n
Problema este cauzat\u0103 de o dep\u0103\u0219ire a tamponului \u00een apelul de sistem execve, care apare \u00een procesarea prefixului specificat \u00een prima linie a scripturilor pentru a determina calea c\u0103tre interpretator (de exemplu, #!\/bin\/sh). Dep\u0103\u0219irea apare la apelul func\u021biei memmove din cauza compunerii gre\u0219ite a unei expresii matematice pentru a calcula dimensiunea argumentelor copiate \u00een tampon. \u00cen loc s\u0103 se scad\u0103 din args->endp valorile args->begin_argv \u0219i consume, din args->endp s-a sc\u0103zut doar valoarea args->begin_argv, iar variabila consume a fost ad\u0103ugat\u0103 la rezultat, ceea ce \u00eenseamn\u0103 c\u0103 s-au copiat mai multe date cu dou\u0103 valori consume. memmove(args->begin_argv + extend, args->begin_argv + consume, - args->endp - args->begin_argv + consume); + args->endp - (args->begin_argv + consume)); <\/p>\n
Dep\u0103\u0219irea permite rescrierea elementelor structurii exec_map aflate \u00een vecin\u0103tatea altui proces. \u00cen exploit, dep\u0103\u0219irea este folosit\u0103 pentru a rescrie con\u021binutul exec_map al proceselor privilegiate care sunt periodic executate \u00een sistem. Ca un astfel de proces este ales sshd, care, de fiecare dat\u0103 c\u00e2nd se stabile\u0219te o conexiune de re\u021bea, creeaz\u0103 prin apelul fork \u0219i execve procesul \/usr\/libexec\/sshd-session cu privilegii root. <\/p>\n
Exploitul injecteaz\u0103 pentru acest proces variabila de mediu LD_PRELOAD=\/tmp\/evil.so, ceea ce duce la \u00eenc\u0103rcarea bibliotecii sale \u00een contextul sshd-session. Biblioteca injectat\u0103 creeaz\u0103 \u00een sistemul de fi\u0219iere un fi\u0219ier executabil \/tmp\/rootsh cu flag-ul suid root. Probabilitatea de succes a dep\u0103\u0219irii este estimat\u0103 la 0,6%, dar datorit\u0103 repet\u0103rii ciclice a \u00eencerc\u0103rilor, exploatarea reu\u0219it\u0103 se ob\u021bine \u00een aproximativ 6 secunde pe un sistem cu CPU quad-core.
<\/center> <\/p>\n
\u00cen plus, \u00een FreeBSD au fost remediate \u0219i alte c\u00e2teva vulnerabilit\u0103\u021bi: <\/p>\n
\n
CVE-2026-35547, CVE-2026-39457 \u2014 buffer overflows in the libnv library, used in the kernel and in base system applications for processing key\/value formatted lists and for organizing data transfer during inter-process communication. The first issue arises from incorrect message size calculations when processing specially formatted IPC message headers. The second issue leads to stack overflow during data exchange through a socket due to the lack of checks to ensure that the socket descriptor size matches the buffer size used in the select() function. Potential vulnerabilities can be exploited to elevate privileges within the system.\n
CVE-2026-42512 \u2014 a remotely exploitable buffer overflow in dhclient, occurring due to incorrect calculations of the pointer array size used to pass environment variables to dhclient-script. The possibility of creating an exploit for remote code execution via the transmission of specially crafted DHCP packets cannot be ruled out.\n
CVE-2026-7164 \u2014 stack overflow in the pf packet filter, occurring when processing specially crafted SCTP packets. The issue is caused by unrestricted recursive parsing of SCTP parameters.\n
CVE-2026-42511 \u2014 the ability to substitute arbitrary directives in dhclient.conf due to improper escaping of double brackets in the BOOTP fields obtained from an external DHCP server. During subsequent parsing of this file by the dhclient process, the field specified by the attacker is passed to dhclient-script, which may be used to execute arbitrary commands with root privileges on systems using dhclient when connecting to a compromised DHCP server controlled by the attacker.\n
CVE-2026-6386 \u2014 inadequate handling of large memory pages in the kernel function pmap_pkru_update_range(). An unprivileged user can cause pmap_pkru_update_range() to treat user space memory as a page in the memory page table, leading to the rewriting of a memory area that should not be accessible.\n
CVE-2026-5398 \u2014 accessing already freed memory in the TIOCNOTTY handler, allowing an unprivileged process to gain root rights. <\/ul>\n
![\"Vulnerabilitate](\"\/wp-content\/uploads\/2026\/05\/6d8779e37e52d9af205b881f8e8a065c.png\")
<\/center> <\/p>\n