[Midnightbsd-cvs] [MidnightBSD/src] 498c4a: elf: fix out-of-bounds write when counting core du...

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: 498c4a63d71276e7469a30da379b421b8f7c17ba
      https://github.com/MidnightBSD/src/commit/498c4a63d71276e7469a30da379b421b8f7c17ba
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    M sys/kern/imgact_elf.c

  Log Message:
  -----------
  elf: fix out-of-bounds write when counting core dump segments

The ELF core dump code counted the dumpable VM map entries, allocated a
program header buffer sized for that count, and then walked the map a
second time to populate the headers.  Both walks take the map lock, but
the lock is dropped in between, so a process sharing the address space
via rfork(2) can add entries between the two passes.  cb_put_phdr() had
no bound on the buffer and simply advanced its pointer for every entry
it was called with, writing program headers past the end of the
allocation.

Record the segment count in the closure and stop filling in headers once
it is reached.  Allocate the header buffer with M_ZERO as well: if the
map shrinks instead of growing, fewer headers are populated than the
count, and the loop that writes out the segment contents still reads
p_vaddr and p_filesz from every one of them.  Without M_ZERO those reads
would take a length and a userspace pointer from uninitialized heap
memory; zeroed headers yield a zero-length write instead.

An unprivileged local user sharing an address space with a process that
dumps core could trigger an out-of-bounds write on the kernel heap,
potentially leading to privilege escalation.

Security:	CVE-2026-58088
Security:	FreeBSD-SA-26:55.elf
Obtained from:	FreeBSD
AI-Assisted-by: Claude Opus 5

Co-Authored-By: Claude Opus 5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications