From nobody Tue Aug 25 16:00:03 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTstX2WjYz6pbYC for ; Tue, 25 Aug 2026 16:00:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTstX0ZwBz42Jx for ; Tue, 25 Aug 2026 16:00:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673604; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/9DZJGUlfg/sM23UN5F+/o5X7GQOTUteB8cqOTcsuhA=; b=q2kFJLpaZ3WKELJBZ29n4asmek38DoHrfD7hx1BXhQQ5xzI6n8UvCJvLP9WVCCQWgySC94 0cojmni52YhP9ncTuSEwvmlMblI4SRFoCa7K4ErI6/TZ/jymaak1gRfcfB9GXrzCLwHhqk y4RCSYK6pjYa7wqbSJThtebnpLdXvMMkulYTT1Xdz4bcLRiDGDb6s/YcpEQBwHFU8eivwC Bh733rPA9x2LWt/J5CeSZxn/a79IHbWvhuA2Jwluko++AzABoA7iCpdkhy2YkN5Cz15/4+ YbRgyQXvE2W0R7PwqhM6tHmtU1mmdlwvOLllzrVeGOAv/qtAK+yBweNWUAxKWA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787673604; a=rsa-sha256; cv=none; b=A+IZC0G4FjPfp4ZZvKDFlByNDyfhs8Gy153QW+ScIXHmzOQDEtVO/FuGpR5yqAYtvgTyxD TboNfNiH5iI5PMA2SXHCkzl/Ezjhh/C4TJI3NTubTMMH9BJHK6FXwSb8kwGbQf+fKuMWXS XMhh5rSoELOYafjmqnrWuZYaHASZpW5BQ3APsjsc2/XAzGoST9iU3uiY4hUmhGpySEGeNx 11aa5O6/U5nHxT8kBMDdeUGDGhwLJbiOoneZGlC68PsjfAoMMM5/uygMtKVRTcWAbJyx4/ csabtAmAkGkPVh6dEq8lZNdXLL/wQ4cGX1gRIlpkf8YnDDBHndDUxDxDIi+Niw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673604; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/9DZJGUlfg/sM23UN5F+/o5X7GQOTUteB8cqOTcsuhA=; b=yXOqQpI+9Q/eVEEx/g0bziifDq12ZEVfKEjjSkOSpmTPoy977BTfYaOUCOMUjg3uj93aJ0 6Pt8WLgecWYUVHmPJrdoyOLBJgaq9gWmkM83jKOn82sGZ+pRQRNkOUwqE7vDWaxwS3QJjB IVnEjL/0NBALwvt9IksfI97ss1oqHfRFPDgE7FAQu7w+ATcq6HDJaYVuYt/U72cDyoMYMy 15bW+iG310wKGP5RHza3vKPHDvDqZ/bQYCsqWWTodzSHXg6MXD4P1PwPtCWk67s+9hMDyl +NDNubXMWZSWgXhizk7SHXYvybWWwB7YWb/WSZM7FrQUlxkYhKKsICxdMF9org== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTstW6SQ2zxZH for ; Tue, 25 Aug 2026 16:00:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 33196 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 25 Aug 2026 16:00:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 6269b9bce0e3 - stable/14 - tty: Revalidate after dropping the tty lock in ioctl handlers List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 6269b9bce0e344336e9cc4f35ebf3fa66d74ca10 Auto-Submitted: auto-generated Date: Tue, 25 Aug 2026 16:00:03 +0000 Message-Id: <6a8dbc03.33196.59dbf1b0@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6269b9bce0e344336e9cc4f35ebf3fa66d74ca10 commit 6269b9bce0e344336e9cc4f35ebf3fa66d74ca10 Author: Mark Johnston AuthorDate: 2026-08-24 18:14:18 +0000 Commit: Mark Johnston CommitDate: 2026-08-25 15:58:57 +0000 tty: Revalidate after dropping the tty lock in ioctl handlers The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the proctree relock. After relocking the tty, it did not revalidate the tty state, and it could end up linking a doomed tty to the calling process' session. This race can be exploited to escalate privileges. TIOCSPGRP has a similar race, fix that too. Approved by: so Security: FreeBSD-SA-26:62.tty Security: CVE-2026-58093 Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59126 --- sys/kern/tty.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index 3bacbde3d1b0..9578dc876ea6 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -1877,7 +1877,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, /* XXX: This looks awful. */ tty_unlock(tp); sx_xlock(&proctree_lock); - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_xunlock(&proctree_lock); + tty_lock(tp); + return (error); + } if (!SESS_LEADER(p)) { /* Only the session leader may do this. */ @@ -1941,7 +1946,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, tty_lock(tp); return (EPERM); } - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_sunlock(&proctree_lock); + tty_lock(tp); + return (error); + } /* * Determine if this TTY is the controlling TTY after