[Midnightbsd-cvs] [MidnightBSD/src] 257e33: ktls: reject shared mbufs on receive decrypt

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 257e33b23ee69457803bc038f8a0a19ebe3fb265
      https://github.com/MidnightBSD/src/commit/257e33b23ee69457803bc038f8a0a19ebe3fb265
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-10 (Wed, 10 Jun 2026)

  Changed paths:
    M sys/kern/uipc_ktls.c
    M tests/sys/kern/ktls_test.c

  Log Message:
  -----------
  ktls: reject shared mbufs on receive decrypt

Avoid decrypting KTLS receive records in place when the detached record contains non-anonymous M_EXTPG pages or sendfile EXT_SFBUF mbufs.  Those buffers may reference file-backed memory and must not be modified by the receive path.

CVE-2026-45257

AI-Assisted-by: OpenAI Codex
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: 8c3251b74eea0d7ccaf612453a0a7975b4fb7e3f
      https://github.com/MidnightBSD/src/commit/8c3251b74eea0d7ccaf612453a0a7975b4fb7e3f
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-10 (Wed, 10 Jun 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: note ktls CVE-2026-45257

AI-Assisted-by: OpenAI Codex
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: 8f0fd3c115156fd5606f4259635d971427b45e4a
      https://github.com/MidnightBSD/src/commit/8f0fd3c115156fd5606f4259635d971427b45e4a
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-10 (Wed, 10 Jun 2026)

  Changed paths:
    M sys/kern/kern_thr.c

  Log Message:
  -----------
  The missing check allows an unprivileged local user who knows or can guess a
target's process and thread IDs to send any signal to a process they would
not normally be permitted to signal, including processes owned by other
users or by root.  The same check enforces jail boundaries, so a jailed
process can signal processes on the host or in other jails.  Thread IDs are
allocated globally and sequentially, and so can be discovered by brute force
with no visibility into the target.

An attacker can stop or terminate arbitrary processes, including critical
system daemons, resulting in a Denial of Service (DoS).

Obtained from: FreeBSD


Compare: https://github.com/MidnightBSD/src/compare/80d3a2bd2fae...8f0fd3c11515

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications