From nobody Tue Aug 25 15:59:24 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTssm4R4Zz6pbMq for ; Tue, 25 Aug 2026 15:59:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTssm1d9dz41SG for ; Tue, 25 Aug 2026 15:59:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=aCdV64b6wPi4GWg4ElJ/kcjYNiN2D1paDSbADr8nzwE=; b=rIRVIFWUOYie8afg29WukBN2Q9kXX9xO4CtDdQVm2Ck7/hrTGR/hmnzRxm1qkvtSWmfE8I tNpAFP8FPI3XSAoBL50/EtUms4BlNKerl3NN6icjAOQFZ9IxFuRKqNnbf4r6V2thMp5xx2 W3aAJC7FFOOzTMmWPYqtte4J5QcvFuC4Y7PpKGUljRCuDCDUUOzEsbIiX6xiwLQvJpC5Kc nH6AK/pMwuGampiNnAzDNoY8vvjQzFU8kxMo33bECr7yKfyVI4xhI6+iUwqyOATq8teEOK UnDxJOl7OpS7Es+vRkasq1PHx70VqTyL9rKIyIav3/0imM95jjtqAMppdRI6hw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787673564; a=rsa-sha256; cv=none; b=XpUciyIb4LrJDiYC67ln738uvQw6jaWn9GWXylmwCmTs2jtwU0D4wp7kr6cTSTABCc7jwP EPRU1ttCf/7/eMHPT4wOpPQbrnrMI6+tHuJEUVf9/GpwgU5sKJw+TubmDZ3AFSFq0THsHV Cl5ZIZvkNnjiyfhGGr/Nx/OoXiQ3AipZWZeXLFqXJARbcvdSAUKkuNOrgCI86WerPkWrMy 0faHs0XEkTRkkVr6Y8snOUjsk0d3GF4QnGDj9UdiS5H9Tu5byQvfZV6jBEYJAc/nOO582N Au/z3+zFBTMHHkcoIdRwEIH0iccEL0elxdiOZ/dTGRyEP+mcEuTn05RI5wGcUQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=aCdV64b6wPi4GWg4ElJ/kcjYNiN2D1paDSbADr8nzwE=; b=CzpVr/eiMFePVonNUv//zCTY6kcluGUUc/Hq9XmWECyY3xkdbitB9g/Dl+p75q/8sbHx+B 2Gx4WuU5qCV2sQ5j17ziwjsrPsTSs2vXdUwPj11uBP6zurJesqrxLIfFxV433/bSa+6twU 7j9xsHBf5egYZuFssxocStqB8RMeG/M/mpz9w0bJFoTlYWw3PATvaFsB3sx7l152xmI+MB u8O4RiDsiha3pvJJVM50zc6U7G7OaxoqF+gCFLmQxIxEJKhoIRo7WyVuv5nsgNej4rsubV d3s68sJu937xRnvZpIIuCa52ouQbrcNHrSusGfJYh9nvkH12Vl05Gt8zbG7uKA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTssm0jxnzxrx for ; Tue, 25 Aug 2026 15:59:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 311bc by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 25 Aug 2026 15:59:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: b207f754c770 - main - tty: Revalidate after dropping the tty lock in ioctl handlers List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b207f754c7709212381eda8c91dbf080081ac5a1 Auto-Submitted: auto-generated Date: Tue, 25 Aug 2026 15:59:24 +0000 Message-Id: <6a8dbbdc.311bc.3d3c297a@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b207f754c7709212381eda8c91dbf080081ac5a1 commit b207f754c7709212381eda8c91dbf080081ac5a1 Author: Mark Johnston AuthorDate: 2026-08-24 18:14:18 +0000 Commit: Mark Johnston CommitDate: 2026-08-25 15:46:24 +0000 tty: Revalidate after dropping the tty lock in ioctl handlers The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the proctree relock. After relocking the tty, it did not revalidate the tty state, and it could end up linking a doomed tty to the calling process' session. This race can be exploited to escalate privileges. TIOCSPGRP has a similar race, fix that too. Approved by: so Security: FreeBSD-SA-26:62.tty Security: CVE-2026-58093 Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59126 --- sys/kern/tty.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index bf1ef6ea6c88..6871853de0be 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -1892,7 +1892,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, /* XXX: This looks awful. */ tty_unlock(tp); sx_xlock(&proctree_lock); - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_xunlock(&proctree_lock); + tty_lock(tp); + return (error); + } if (!SESS_LEADER(p)) { /* Only the session leader may do this. */ @@ -1959,7 +1964,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, pg != NULL ? pg->pg_id : -1, td->td_proc->p_session->s_sid)); } - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_sunlock(&proctree_lock); + tty_lock(tp); + return (error); + } /* * Determine if this TTY is the controlling TTY after