From nobody Tue Aug 25 16:01:09 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTsvp02M3z6pbmJ for ; Tue, 25 Aug 2026 16:01:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTsvn4tvZz44Ll for ; Tue, 25 Aug 2026 16:01:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673669; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0xtSMDOfRf2lvdzgDDFAIXkXxLNXbr1swyyAuVxJvLs=; b=SfxZVNoUdsas9nThatCkzIoNBHW4/A6Paf/39XTKll3ON14+z+h2CBsBsoPXtM1P+iclhj 3frPfegzgXaWp8t2PNAJu2RnvBgNsdOoKNXDP+Dn5oJ5H3r/eyUEHoqbnzNZCc1tLQF9mJ w0cQQCA72xbNL+bBxqKhF9eLKzSCefnN+PjCACs20IiVaT5lA2xf/FoRYHn6XHcbRxwnda 6slLxArqQPGI47R3Eq3MEJlnD25f1jwrY8PHHG6Am/rr+YRSV7OTbY7NOCpTOlEVFHdQd8 gNUWPKviF8TEiSD9eSDuAWO6TLVtpQxT7K6+g8FdcbfFmVmjR+zSv4yKdzA+Jg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787673669; a=rsa-sha256; cv=none; b=OR1Yp3dRwwObyFxt4uYF280+5gznJV5T6gXXpgUZrzMmTw3swZuSU7U1mshpEbacGkBy/o mT0BBb4EqKiMiiKEcFKrOSqgy5KQnwhSu53z8YPEjoLTMN8myHxCbGg8pE6zjjOf1CbM64 t41aoFkEpHT+pEOV0uV4hf3lYREVswsj1fjaN9l8R8CUeWnE2FhRkcX967MN/Ys1bemRJq GuXD8vP1rJmJdOhle/QnuB0V5bVGqNQ2XXFxMHUrBJR9C43XwEo2g7lloYHgF9X69vKE7M FQM26JID3UlKZL6LCR1i36olqtxg8zQVXqxvod+LMaEHZ5bsq/htVNmSzd/fGA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673669; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0xtSMDOfRf2lvdzgDDFAIXkXxLNXbr1swyyAuVxJvLs=; b=NdK4+WYiHIuQesFzSHABPmdb5EJpXA/V5o+bYcHegiECURxsXljs6XHdUvXLEyUAjV/Uy3 KM1isRP8jBda4Ywg41CYz+kwcv5wxwaMtseVx/952Xpn2KkcQD8ZBMoXTMFr2JuQShBOCR sA4K5QoqzvfBCmrd+iNk1pa3htKolLIiu8GMSRfNzIj3X6t8xR692Wbwp5FZ2ER/b7s4QU yGsO8fE30JEbcSzI8c1AQcrlosIcNV3QnHtwhfj70GjHkC3v2RdQqKG7q8/9nMmW4FkzJb YzN6NXs8RJADVLecE+MvdXf0qFfxmGoVPYTT7HZZQ7KlMo9sjLLjBgNnWI19cA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTsvn3f7fzxtS for ; Tue, 25 Aug 2026 16:01:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3378a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 25 Aug 2026 16:01:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 45a190c827e4 - releng/15.0 - tty: Revalidate after dropping the tty lock in ioctl handlers List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 45a190c827e4b3b57b8c9799731cb1baf5554e04 Auto-Submitted: auto-generated Date: Tue, 25 Aug 2026 16:01:09 +0000 Message-Id: <6a8dbc45.3378a.2e5b76d9@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=45a190c827e4b3b57b8c9799731cb1baf5554e04 commit 45a190c827e4b3b57b8c9799731cb1baf5554e04 Author: Mark Johnston AuthorDate: 2026-08-24 18:14:18 +0000 Commit: Mark Johnston CommitDate: 2026-08-24 21:51:22 +0000 tty: Revalidate after dropping the tty lock in ioctl handlers The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the proctree relock. After relocking the tty, it did not revalidate the tty state, and it could end up linking a doomed tty to the calling process' session. This race can be exploited to escalate privileges. TIOCSPGRP has a similar race, fix that too. Approved by: so Security: FreeBSD-SA-26:62.tty Security: CVE-2026-58093 Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59126 --- sys/kern/tty.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index 356a69682997..d8df12365302 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -1868,7 +1868,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, /* XXX: This looks awful. */ tty_unlock(tp); sx_xlock(&proctree_lock); - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_xunlock(&proctree_lock); + tty_lock(tp); + return (error); + } if (!SESS_LEADER(p)) { /* Only the session leader may do this. */ @@ -1932,7 +1937,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, tty_lock(tp); return (EPERM); } - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_sunlock(&proctree_lock); + tty_lock(tp); + return (error); + } /* * Determine if this TTY is the controlling TTY after