{"id":170544,"date":"2026-05-09T12:24:31","date_gmt":"2026-05-09T10:24:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd"},"modified":"2026-05-09T12:24:31","modified_gmt":"2026-05-09T10:24:32","slug":"uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-sistemnom-vyzove-execve-predostavlyayushhaya-root-dostup-vo-freebsd","title":{"rendered":"S\u00e5rbarhet i systemanropet execve som ger root-\u00e5tkomst i FreeBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
En FreeBSD har en s\u00e5rbarhet (CVE-2026-7270) identifierats, vilket till\u00e5ter en icke-privilegerad anv\u00e4ndare att k\u00f6ra kod med k\u00e4rnr\u00e4ttigheter och f\u00e5 root-\u00e5tkomst till systemet. S\u00e5rbarheten p\u00e5verkar alla versioner av FreeBSD som har skapats sedan 2013. En exploit f\u00f6r s\u00e5rbarheten finns tillg\u00e4nglig offentligt och har testats p\u00e5 system med FreeBSD 11.0 till 14.4. S\u00e5rbarheten har \u00e5tg\u00e4rdats i uppdateringar f\u00f6r FreeBSD 15.0-RELEASE-p7, 14.4-RELEASE-p3, 14.3-RELEASE-p12 och 13.5-RELEASE-p13. F\u00f6r \u00e4ldre versioner kan en patch anv\u00e4ndas. <\/p>\n
Problemet orsakas av en buffert\u00f6verskrivning i systemanropet execve, som uppst\u00e5r vid hantering av prefixet som anges i den f\u00f6rsta raden av skripten f\u00f6r att definiera s\u00f6kv\u00e4gen till tolken (t.ex. #!\/bin\/sh). \u00d6verskrivningen intr\u00e4ffar vid anropet av funktionen memmove p\u00e5 grund av felaktig sammans\u00e4ttning av det matematiska uttrycket f\u00f6r att ber\u00e4kna storleken p\u00e5 de argument som kopieras till bufferten. Ist\u00e4llet f\u00f6r att subtrahera fr\u00e5n args->endp-v\u00e4rdena args->begin_argv och consume, subtraherades endast v\u00e4rdet args->begin_argv fr\u00e5n args->endp, och variabeln consume lades till resultatet ist\u00e4llet f\u00f6r att subtraheras, vilket betyder att mer data kopierades med tv\u00e5 v\u00e4rden av consume. \tmemmove(args->begin_argv + extend, args->begin_argv + consume, \u2014\t args->endp \u2014 args->begin_argv + consume); +\t args->endp \u2014 (args->begin_argv + consume)); <\/p>\n
\u00d6verskrivningen m\u00f6jligg\u00f6r skrivning av strukturelementen exec_map som finns i angr\u00e4nsande minnesomr\u00e5de fr\u00e5n en annan process. I utnyttjandet anv\u00e4nds \u00f6verskrivningen f\u00f6r att skriva \u00f6ver inneh\u00e5llet i exec_map f\u00f6r privilegierade processer som regelbundet k\u00f6rs i systemet. Som en s\u00e5dan process valdes sshd, som vid varje uppr\u00e4ttande av en n\u00e4tverksanslutning avskiljer en process \/usr\/libexec\/sshd-session med rootbeh\u00f6righeter genom anrop av fork och execve. <\/p>\n
Utnyttjandet s\u00e4tter f\u00f6r denna process milj\u00f6variabeln LD_PRELOAD=\/tmp\/evil.so, vilket leder till att dess bibliotek laddas i kontexten av sshd-sessionen. Det angivna biblioteket skapar en k\u00f6rbar fil \/tmp\/rootsh i filsystemet med suid-rootflagga. Chansen f\u00f6r en framg\u00e5ngsrik \u00f6verskrivning uppskattas till 0,6%, men tack vare cyklisk upprepning av f\u00f6rs\u00f6k uppn\u00e5s en lyckad utnyttjande p\u00e5 ungef\u00e4r 6 sekunder p\u00e5 ett system med en 4-k\u00e4rnig CPU.
<\/center> <\/p>\n
Dessutom har flera andra s\u00e5rbarheter \u00e5tg\u00e4rdats i FreeBSD: <\/p>\n
\n
CVE-2026-35547, CVE-2026-39457 \u2014 buffer overflow in the libnv library, used in the kernel and in basic system applications for processing key\/value formatted lists and for organizing data transfer during inter-process communication. The first issue is caused by an incorrect calculation of the message size when processing specially formatted IPC message headers. The second issue leads to stack overflow during data exchange via socket due to the lack of a matching check between the socket descriptor size and the buffer size used in the select() function. These vulnerabilities could potentially be exploited to elevate privileges in the system.\n
CVE-2026-42512 \u2014 remotely exploitable buffer overflow in dhclient, arising from incorrect calculation of the size of the array of pointers used for passing environment variables to dhclient-script. The possibility of creating an exploit for remote code execution via specially crafted DHCP packets cannot be ruled out.\n
CVE-2026-7164 \u2014 stack overflow in the pf packet filter, occurring while processing specially crafted SCTP packets. The issue is caused by unbounded recursive parsing of SCTP parameters.\n
CVE-2026-42511 \u2014 the possibility of injection of arbitrary directives into dhclient.conf due to improper escaping of double brackets in BOOTP fields obtained from an external DHCP server. When the defined field is later parsed by the dhclient process, it is passed to dhclient-script, which can be used to execute arbitrary commands with root privileges on systems using dhclient when contacting a malicious DHCP server.\n
CVE-2026-6386 \u2014 insufficient handling of large memory pages in the kernel function pmap_pkru_update_range(). An unprivileged user can force pmap_pkru_update_range() to handle memory from user space as a page in the memory page table, leading to overwriting of inaccessible memory areas.\n
CVE-2026-5398 \u2014 access to already freed memory area in the TIOCNOTTY handler, allowing an unprivileged process to gain root rights. <\/ul>\n
![\"S\u00e5rbarhet](\"\/wp-content\/uploads\/2026\/05\/6d8779e37e52d9af205b881f8e8a065c.png\")
<\/center> <\/p>\n