From nobody Tue Aug 25 15:59:52 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTstJ4lyrz6pbXt for ; Tue, 25 Aug 2026 15:59:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTstJ252Zz42C2 for ; Tue, 25 Aug 2026 15:59:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673592; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rnDSzoD9ONBa6fblUKkQ0fFL1nbpQFRKz7iEKzdHAic=; b=kxxzXh0PgbiJdPHjqJ8Cn3QxJv1SjE9jGDhyx9TbqFI2PAduXa57AMW6Qh7cIUiWyMuN+o Vw1Jj6Jdqk7lnrrAOlFcSX83GHniXUV15H6+jiIfdPpvsL/jVo4P4dRq1wMgdwRl+SUz7w IkaOqS0UYMtrMf9emFMleNxqdE1Iud2EuX4yCZAD7FBhmf/klZJcbglKVM4wYkm7EqHoJL Ljccx44boTk9KwH36nl6hsh/P5yu9p0fbTOwdx9/SKDPma2c7uyn0d6xl1uP7Et/A+0sgA fmWU7lk7JJeJrU/THOuvDd9aetN3Hh6iko+NTddXLHsPscByanCeT7Ob0thrFg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787673592; a=rsa-sha256; cv=none; b=sRG0lN7oCzaBOk0ofdTQd/kdGZA/jQqjSUoGxHP+JeGbHOETAcPETTv4EIQswrjcSTOKyW +zO2aQCT6WOZMz7WfK4PjOrabdz08Yt/EXkqlisEwqvq8rfIqPDdf2cOw7xaq/1TcVSwSi vHNv8q7+noxh22V2vk9qFjz/FIUOtRatuWYpGe/FNfmQE04NU3DESEVGXFij4oXt6UqpSW MXFmMckKsvcizfYk8WPG9fnAqZi+7/T2Ogw++gBL5e3KAhg5xUUrr25YvjCBLoSYjQXElT NvU/ZPM4C2sOrS1dOSSB8pkXdGOYevne7WKnJlzcOwdprHHEOOZPr5GtfXZNtQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673592; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rnDSzoD9ONBa6fblUKkQ0fFL1nbpQFRKz7iEKzdHAic=; b=ntl9aoYwXuYD33MPYYQvY2YUi7MeS4hzhPX34MaTU35eidVSU0x3HXKClWP2bKw1Gt4QBx e4kjMVhdn0I9AVzabHCAKrUWWj/yuxnnKkx2UC8Jsr9qjLsMjH6rcgKg9RUKVKAPyPqVsk 3XA07H9uXV0N38v9/WhHqSzAWkURB4CmDvQLj4UQlfCew4cIV7+sSyhrVh1+rt+c0WFrKC 9bCTo921rVQkQKn8npNmZ/93eF61UKPwxfXjk2LFuF52UbLuRri24APqx/hYHYdg8wHqeC HB74Tcpl0A40RXQTElkHBITlOYZakkMUmUXT0Zo46ZZhJyJpgg9YurOKXbd6ag== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTstJ12vrzxbZ for ; Tue, 25 Aug 2026 15:59:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 311c0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 25 Aug 2026 15:59:52 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: c7cec6fa6e4a - stable/15 - tty: Revalidate after dropping the tty lock in ioctl handlers List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: c7cec6fa6e4aeca7488130e17f4fd1ad2c476fa0 Auto-Submitted: auto-generated Date: Tue, 25 Aug 2026 15:59:52 +0000 Message-Id: <6a8dbbf8.311c0.34e31395@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c7cec6fa6e4aeca7488130e17f4fd1ad2c476fa0 commit c7cec6fa6e4aeca7488130e17f4fd1ad2c476fa0 Author: Mark Johnston AuthorDate: 2026-08-24 18:14:18 +0000 Commit: Mark Johnston CommitDate: 2026-08-25 15:47:13 +0000 tty: Revalidate after dropping the tty lock in ioctl handlers The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the proctree relock. After relocking the tty, it did not revalidate the tty state, and it could end up linking a doomed tty to the calling process' session. This race can be exploited to escalate privileges. TIOCSPGRP has a similar race, fix that too. Approved by: so Security: FreeBSD-SA-26:62.tty Security: CVE-2026-58093 Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59126 --- sys/kern/tty.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index 09ed1c6d0c5d..f412205a3d2b 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -1890,7 +1890,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, /* XXX: This looks awful. */ tty_unlock(tp); sx_xlock(&proctree_lock); - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_xunlock(&proctree_lock); + tty_lock(tp); + return (error); + } if (!SESS_LEADER(p)) { /* Only the session leader may do this. */ @@ -1954,7 +1959,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, tty_lock(tp); return (EPERM); } - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_sunlock(&proctree_lock); + tty_lock(tp); + return (error); + } /* * Determine if this TTY is the controlling TTY after