[Midnightbsd-cvs] [MidnightBSD/src] 37f190: Fix ASLR bypass for setuid executables via procctl...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 37f19045dbed1e0ff2d41722f6ed899432406bf0
      https://github.com/MidnightBSD/src/commit/37f19045dbed1e0ff2d41722f6ed899432406bf0
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-10 (Wed, 10 Jun 2026)

  Changed paths:
    M sys/kern/imgact_elf.c
    M tests/sys/kern/Makefile
    A tests/sys/kern/aslr.c

  Log Message:
  -----------
  Fix ASLR bypass for setuid executables via procctl(2) (CVE-2026-49414)

The ELF image activator cleared per-process ASLR preference flags for
setuid binaries after the code that computes the PIE base address.  An
unprivileged user could call procctl(PROC_ASLR_CTL, PROC_ASLR_FORCE_DISABLE)
before execve(2) to disable ASLR for a setuid PIE binary, significantly
easing exploitation of memory corruption vulnerabilities in that binary.

Move VOP_UNLOCK and the credential_setid flag-clearing block to before
the et_dyn_addr computation so that user-set ASLR disable preferences are
cleared before the PIE load base is chosen.  Add a re-lock on the
BI_CAN_EXEC_DYN error exit path introduced by the reordering.

Add a regression test (tests/sys/kern/aslr.c) that verifies ASLR remains
active for setuid binaries even when an unprivileged caller has requested
force-disable.

Security: CVE-2026-49414
Security: FreeBSD-SA-26:32.elf

Co-Authored-By: Claude Sonnet 4.6 <noreply at anthropic.com>


  Commit: 8b90ecc242023b912941c5ebe9076f36a79b121b
      https://github.com/MidnightBSD/src/commit/8b90ecc242023b912941c5ebe9076f36a79b121b
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-10 (Wed, 10 Jun 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: note CVE-2026-49414 ASLR bypass fix


Compare: https://github.com/MidnightBSD/src/compare/0f95ff72d5f5...8b90ecc24202

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications