[Midnightbsd-cvs] [MidnightBSD/src] 93b133: unlinkat: Respect AT_RESOLVE_BENEATH in unlinkat(2...

[Lucas Holt]

  Branch: refs/heads/stable/4.1
  Home:   https://github.com/MidnightBSD/src
  Commit: 93b1330b5d78f43291d86a9d6c0742aa127e7078
      https://github.com/MidnightBSD/src/commit/93b1330b5d78f43291d86a9d6c0742aa127e7078
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M sys/kern/vfs_syscalls.c

  Log Message:
  -----------
  unlinkat: Respect AT_RESOLVE_BENEATH in unlinkat(2)/funlinkat(2)

kern_funlinkat_ex() validated the AT_RESOLVE_BENEATH flag but then called
kern_frmdirat()/kern_funlinkat() with a hardcoded flag argument of 0,
silently dropping the flag so that path resolution was not actually
restricted.  It also hardcoded UIO_USERSPACE instead of passing through
its pathseg parameter.

Pass the flags (minus AT_REMOVEDIR) and pathseg through to the underlying
lookup, which already honors AT_RESOLVE_BENEATH via at2cnpflags().

A caller relying on AT_RESOLVE_BENEATH with unlinkat(2)/funlinkat(2) for
path containment could delete files outside the intended directory tree.

Ported from the FreeBSD fix for SA-26:42.unlinkat (FreeBSD commit
7982ae91a51a), by Mark Johnston.

Security:	FreeBSD-SA-26:42.unlinkat
Security:	CVE-2026-49421
Obtained from:	FreeBSD

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply at anthropic.com>


  Commit: d0ce2eea486194d1e03da527b4bad8191c56ff51
      https://github.com/MidnightBSD/src/commit/d0ce2eea486194d1e03da527b4bad8191c56ff51
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: Note SA-26:42.unlinkat fix

Security:	FreeBSD-SA-26:42.unlinkat
Security:	CVE-2026-49421

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply at anthropic.com>


Compare: https://github.com/MidnightBSD/src/compare/4d1db17549bb...d0ce2eea4861

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications