From nobody Tue Aug 25 16:00:42 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTsvG4rrjz6pbZP for ; Tue, 25 Aug 2026 16:00:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTsvG2L49z43PF for ; Tue, 25 Aug 2026 16:00:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673642; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fVakkZ73TOVG9pDJUcPxfzixHvGRwJIP8ltvMahZLQ4=; b=ZqSxMuYE0G6FLZCoTXzRon802OybFEHfV1ExvK5h52627DW/BnmNNnCOya8YceRhFoefjJ eKelx65nYRZjTfJtvlX+xn5sTx2k6o90jtVH8oLGKZMndCw3ZJmCA9BUPFtpVL8tgBx0hU SkzBPdSx8ahvzJCiXXBF4IxTQPpasFKlFs9OYa5ImXQKdks8rsh/Iay9CWRVpi7d2QsJfY vy+jZAFwqgcT1FenDHWdjmsfLMpazY1yjBIJY63XuaEFNu4jA1DBuHhM5SJF900vIwgAsx NIjdn8SHBDxrxwZKlgekTJWuXSTbnijioiNL+zyJdagRMsvjt0i8yeFc9LF6QA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787673642; a=rsa-sha256; cv=none; b=Rgi6SFFxZQly4P9D/V/1nPb3cs/Amev40wDtJOs3nzRP6K0u5vCVrRRx7uFYTjxVgvtaVZ K8FUUv+2blRB2gzFnmDjJgZe+mPS1qWbIX1W8waCxceltZgx4xJ1UCam+QaBn+axweTAa3 LyTr7FfMXQxnSXsuDjLhWtK8Bf5r+8ConbX1/KlO6I9/6lwUAQLsiAz9vMS5DRwtSj6XUR x5yo+dpe3TZfnon2en0WzeBHq1bQ5ik1tyhM41CRIxN2KJpsSRB+uzY7/pUqk7tPmsEOw7 QlCOPrUEhyegpezKNX6J4ViOa520xVYcdOnSAFRo6h3PXcN35XTHdOCwJ+Vg9Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673642; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fVakkZ73TOVG9pDJUcPxfzixHvGRwJIP8ltvMahZLQ4=; b=yEfZnHpSWPRpV44MV/IRqzqA/NrUfnLOZ3lXq3PTNUVuNhHA7V+p0AvNz3zeVk9zpzQG5x MI0FFrI2nrZK7JDOVBk/Zx2w3NHjfSrSjM4KFX1aZwSR+JUdkorPgCw1u8wL7VLp21cHXd IIaYE2qnL+v+QVDJWDR448oNUDY1aaplKmtG/U6sL/Sy84F3cy+YjvS+cWCAcT5zpB62r1 /PRyJ9BEGGZZ9DuVsArEvKrG3Nw24vABgygTbhCPokEaaymTH8cLVs6T5bY3u7sqd8hnUx ebzex7nf8YwSP3e16O1RstKYrCRVzIBhztRU1GruhGntW8kT1jIgq0VhJl+d1w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTsvG0R1fzxsD for ; Tue, 25 Aug 2026 16:00:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 32645 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 25 Aug 2026 16:00:42 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 1aefa1fab9b5 - releng/14.5 - tty: Revalidate after dropping the tty lock in ioctl handlers List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.5 X-Git-Reftype: branch X-Git-Commit: 1aefa1fab9b5001e6ccb6f9d124bc6e3d6304742 Auto-Submitted: auto-generated Date: Tue, 25 Aug 2026 16:00:42 +0000 Message-Id: <6a8dbc2a.32645.33033a8b@gitrepo.freebsd.org> The branch releng/14.5 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=1aefa1fab9b5001e6ccb6f9d124bc6e3d6304742 commit 1aefa1fab9b5001e6ccb6f9d124bc6e3d6304742 Author: Mark Johnston AuthorDate: 2026-08-24 18:14:18 +0000 Commit: Mark Johnston CommitDate: 2026-08-24 19:04:32 +0000 tty: Revalidate after dropping the tty lock in ioctl handlers The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the proctree relock. After relocking the tty, it did not revalidate the tty state, and it could end up linking a doomed tty to the calling process' session. This race can be exploited to escalate privileges. TIOCSPGRP has a similar race, fix that too. Approved by: re (cperciva) Approved by: so Security: FreeBSD-SA-26:62.tty Security: CVE-2026-58093 Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59126 --- sys/kern/tty.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index 3bacbde3d1b0..9578dc876ea6 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -1877,7 +1877,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, /* XXX: This looks awful. */ tty_unlock(tp); sx_xlock(&proctree_lock); - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_xunlock(&proctree_lock); + tty_lock(tp); + return (error); + } if (!SESS_LEADER(p)) { /* Only the session leader may do this. */ @@ -1941,7 +1946,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, tty_lock(tp); return (EPERM); } - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_sunlock(&proctree_lock); + tty_lock(tp); + return (error); + } /* * Determine if this TTY is the controlling TTY after