From nobody Tue Aug 25 16:01:29 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTswB2Wt7z6pc0R for ; Tue, 25 Aug 2026 16:01:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTswB0nfPz44Yx for ; Tue, 25 Aug 2026 16:01:30 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673690; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZWp6ccDeDFmOoPk3s+qEJjuAyfJnmKIUDyoonU01Oyg=; b=v2e5MQ2/On//j64drNUbzvazc3v8vE3x2+JsIsG/1u9Mhes2wwUUu5j6bWIV5MMlhrIA+T QVka9hZVGXUo2sNZMwtrvAsMT9yU0BL81a4yM/BIZ5XPvblSEYUITpiCChpTUtE8PaSt2a 7YE4SgF6Jdvu7ju9f//4WlltD09kIIoyLYb2zF5N/P9eCmFId/J2FZyR1ba117yRpWvRmj LOGTJtndHeQX95ID3OG2rGMF8pzcd2FBMl5Oog3VfpKwDPhRip6N8sWdrf77qQ1uy2l8wM gItlLUqn5wSxDi3NSsuygpBitLWMxRc5WEV7RN69tIkAhYCqac/CH7ChrnR8AQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787673690; a=rsa-sha256; cv=none; b=ATgCwBDcGn/9qssMw658xQZUVZRXWi+aS6fvs2miIBafLIRh1Kwi4j0KFIMPL8SNuobkxd HfqxvFnBcAUvDw1JPcu1D6o25sGU/fnpDHa6qzKTJBC/M0XPfSJQJgn68iYiHo1x9TBV58 Q8mcGMsThhNCBsuHWlIp3lfM6IKaO048+N9pf3rCRD1P+CPp46s2Ah40ZgxKNnG874tZCU ttNpjgRLTec1C1wc6Pu/yEjaGFX4nsHm89/pBUFMBbI4V6mQ0tINNFIG5PaIfyydZyRDVW 0m+Th3scVibEDfMLcRC5Tv88bIrWoL0a8SdtuJGI8ajn2BKb6Pae7aDf5/3wew== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673690; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZWp6ccDeDFmOoPk3s+qEJjuAyfJnmKIUDyoonU01Oyg=; b=xmuNQ47cfzZOLopn/9cxopkjnA/VZT2f7sb4Bl9w2e4ogzBdJWYndqUHMz0c+Hj/0UngTd HIN6F1LJKES33fUdU215viEBGYIn4wrDFosdnJHDK4ewSEN8JkNwOAmjDdaCXwyKTyZmuI m08oMXjwtLqRj5dyLbLll+2RS7yDcZB7zi5F7qEsezbGBDmwU34WnKEhlmuymizSFUuLVq Rv4F8IktaUonMXcp5PEQH5BNXIwwMcz2rY3TJC1etFWxxCW6LErz0B4oVRmdR2BFDhFFz9 nP4232UVOxpwZU24qjVJdV9IlK3UEdNNPYJhm6EbROb97Kt8UogmWw/ezM+xyw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTsw963s1zyBM for ; Tue, 25 Aug 2026 16:01:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3312a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 25 Aug 2026 16:01:29 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: b936c3417027 - releng/15.1 - tty: Revalidate after dropping the tty lock in ioctl handlers List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: b936c3417027dac6048f6ba10ea58ba104725e4b Auto-Submitted: auto-generated Date: Tue, 25 Aug 2026 16:01:29 +0000 Message-Id: <6a8dbc59.3312a.4641445a@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b936c3417027dac6048f6ba10ea58ba104725e4b commit b936c3417027dac6048f6ba10ea58ba104725e4b Author: Mark Johnston AuthorDate: 2026-08-24 18:14:18 +0000 Commit: Mark Johnston CommitDate: 2026-08-24 21:51:29 +0000 tty: Revalidate after dropping the tty lock in ioctl handlers The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the proctree relock. After relocking the tty, it did not revalidate the tty state, and it could end up linking a doomed tty to the calling process' session. This race can be exploited to escalate privileges. TIOCSPGRP has a similar race, fix that too. Approved by: so Security: FreeBSD-SA-26:62.tty Security: CVE-2026-58093 Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59126 --- sys/kern/tty.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index afba05ec27b4..430a0e06c34e 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -1870,7 +1870,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, /* XXX: This looks awful. */ tty_unlock(tp); sx_xlock(&proctree_lock); - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_xunlock(&proctree_lock); + tty_lock(tp); + return (error); + } if (!SESS_LEADER(p)) { /* Only the session leader may do this. */ @@ -1934,7 +1939,12 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *data, int fflag, tty_lock(tp); return (EPERM); } - tty_lock(tp); + error = ttydev_enter(tp); + if (error != 0) { + sx_sunlock(&proctree_lock); + tty_lock(tp); + return (error); + } /* * Determine if this TTY is the controlling TTY after