From nobody Tue Aug 25 16:00:30 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTsv31lfZz6pbKg for ; Tue, 25 Aug 2026 16:00:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTsv26XrNz42xy for ; Tue, 25 Aug 2026 16:00:30 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673630; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IhLGe6bSwUrBdAoluWICX1E3sLodfypYFPlCrBV4Uoo=; b=XZDxAjFD3Sfl3TY9CNfezbCKjmwv63OnMkU7BqZHoRRS+M25vrqb6JI6qDcda+3hiyuFm1 2w/Hk/WS2AcjrStZR8KMQIbD7GuNjLGbCpmPmUp/sqE4gdUAHfxSRJ2gD3mP1ZoJBfCfVA 2WmKnB6oqNyOqCu9OMZTopsEmtWZ77okW4lqI3FkYyphMtk8ky3ZinUefXcYN/S/rLjH6A 9FmNGvspLZZS77ZMC+W5PN2NzvivY1cKDXYZwvlNzyzavz32NEO4ooGVT7SlNEEtK9CmJz kdHYZgX3x94Q9FZqjiHiiUtyl8nLszqDPLjRDORn/vtsc6pUl+cs7rasmXJt8Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787673630; a=rsa-sha256; cv=none; b=rWzot35u1AJY/kdYs52QtsUoc4C5WOvyIY1laYk6yLN/TIJPaHTpTy2KgMI0jB3wUr1Km5 wKFe1PET0cNKIm/9ikL2cAkad77uj2YL50QtNfRuVQ29JSdqP750ugN/WTQDxxhPYG+xH5 9VutTPezehx1ZOKEioAwIh2QkcEi4u0Oo0TXNNN7BF1ObLK1FIOM+9iXwttwuJYP5s3L6F fO6JiHSy8reRZQ5baO0CVSa+nl8zECJWhv81ughSdY7OZ9Adg7R8tkYBOGm094C0EWrrGX EfxMzqggqXm2DlgNjZCYmPzum6bxJ4278bVtcT6mxqxGksmg1o88YKMpqCjfsQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673630; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IhLGe6bSwUrBdAoluWICX1E3sLodfypYFPlCrBV4Uoo=; b=mNOR+aJBhE/U/37m5Rd3S/81Sk7SDcuN+9vKabjoYbK2joz8ymBSRpuMPg/T82MNFZn2sL H/wzGa0mj5nyj015AtREH06domR52ZJiQHTEeHHTYHJsxAv2DPdGnxQD/XIVXc0V7PBJGm GZhmpgGwqYrsXWQTKtY4Cnz/QkeYPGeY7HJiWw5ct67q61GTG8BQ9Lh+vDC2ZWKfEEoPlL RZ5AKQ8TvbQOAiTr4DdVm5gy9M/7mgsj5DXJXnafr8DQuTRIKikMo+nnoVKKXqt71dQsNI yF58pp+/mo79nnamjN1C2oD9D/vfA4+n+fM/2/J7NUbrLPnG2cAGlx2gKS/CoQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTsv25c77zxW6 for ; Tue, 25 Aug 2026 16:00:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 33094 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 25 Aug 2026 16:00:30 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: d7883b84b1e1 - releng/14.4 - tty: Revalidate after dropping the tty lock in ioctl handlers List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: d7883b84b1e1d64c4ef7df5a6d05a91b74060f3f Auto-Submitted: auto-generated Date: Tue, 25 Aug 2026 16:00:30 +0000 Message-Id: <6a8dbc1e.33094.76de35f0@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d7883b84b1e1d64c4ef7df5a6d05a91b74060f3f commit d7883b84b1e1d64c4ef7df5a6d05a91b74060f3f Author: Mark Johnston AuthorDate: 2026-08-24 18:14:18 +0000 Commit: Mark Johnston CommitDate: 2026-08-24 18:59:49 +0000 tty: Revalidate after dropping the tty lock in ioctl handlers The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the proctree relock. After relocking the tty, it did not revalidate the tty state, and it could end up linking a doomed tty to the calling process' session. This race can be exploited to escalate privileges. TIOCSPGRP has a similar race, fix that too. Approved by: so Security: FreeBSD-SA-26:62.tty Security: CVE-2026-58093 Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59126 --- sys/kern/tty.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index 508fa10fdd62..a5ae74791600 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -1869,7 +1869,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, /* XXX: This looks awful. */ tty_unlock(tp); sx_xlock(&proctree_lock); - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_xunlock(&proctree_lock); + tty_lock(tp); + return (error); + } if (!SESS_LEADER(p)) { /* Only the session leader may do this. */ @@ -1933,7 +1938,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, tty_lock(tp); return (EPERM); } - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_sunlock(&proctree_lock); + tty_lock(tp); + return (error); + } /* * Determine if this TTY is the controlling TTY after