[Midnightbsd-cvs] [MidnightBSD/src] 3709d3: tcp: Fix use-after-free in RACK stack setsockopt h...

[Lucas Holt]

  Branch: refs/heads/stable/4.1
  Home:   https://github.com/MidnightBSD/src
  Commit: 3709d32431b0a8356c6b4458625575d54910db85
      https://github.com/MidnightBSD/src/commit/3709d32431b0a8356c6b4458625575d54910db85
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M sys/netinet/tcp_stacks/rack.c

  Log Message:
  -----------
  tcp: Fix use-after-free in RACK stack setsockopt handler

rack_set_sockopt() drops the connection lock to copy option data from
userspace, then reacquires it.  After reacquiring, it verifies that the
TCP stack had not been switched away (tp->t_fb != &__tcp_rack), but did
not reload its pointer to the stack's per-connection control block.  If
userspace switches stacks twice during this window, the check succeeds
but the saved rack pointer refers to freed memory.

Reload rack from tp->t_fb_ptr after re-validating the stack.

The bug may be exploitable by an unprivileged local user to escalate
privileges.  Only systems that have loaded tcp_rack.ko are affected;
the module is not loaded by default.

Ported from the FreeBSD fix for SA-26:43.tcp (FreeBSD commit
df8885512da5), by Michael Tuexen.

Security:	FreeBSD-SA-26:43.tcp
Security:	CVE-2026-49422
Obtained from:	FreeBSD

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply at anthropic.com>


  Commit: 4d1db17549bbbdcc6b35f445d7a722c4e0236145
      https://github.com/MidnightBSD/src/commit/4d1db17549bbbdcc6b35f445d7a722c4e0236145
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: Note SA-26:43.tcp fix

Security:	FreeBSD-SA-26:43.tcp
Security:	CVE-2026-49422

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply at anthropic.com>


Compare: https://github.com/MidnightBSD/src/compare/29f29ec2324a...4d1db17549bb

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications