Local privilege escalation via execve()

#1

Post by Deeg9rie9usi » Sat, May 09, 2026, 8:31 PM UTC

Local privilege escalation via execve()
freebsd.org

Re: Local privilege escalation via execve()

#2

Post by rvz » Sat, May 09, 2026, 8:45 PM UTC

> IV. Workaround

> No workaround is available.

Oh dear.

Re: Local privilege escalation via execve()

#3

Post by itsthefrank » Sat, May 09, 2026, 8:56 PM UTC

rvz wrote: post #2

> IV. Workaround > No workaround is available. Oh dear.

> V. Solution

> Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system.

Not everyone can just freebsd-update and reboot, so yes, "Oh dear." is a good response to this.

Re: Local privilege escalation via execve()

#4

Post by epcoa » Sat, May 09, 2026, 9:01 PM UTC

itsthefrank wrote: post #3

rvz wrote: post #2

> IV. Workaround > No workaround is available. Oh dear.

> V. Solution > Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Not everyone can just freebsd-update and reboot, so yes, "Oh dear." is a good response to this.

Anyone relying on a 30+ year old monolith kernel written in C to not have some exploitable LPEs lurking should stay in basket weaving and out of sysadmin.

Re: Local privilege escalation via execve()

#5

Post by doublerabbit » Sat, May 09, 2026, 9:03 PM UTC

Linux is on their second and FreeBSD is on their first. How many is Windows on?

Re: Local privilege escalation via execve()

#6

Post by cyberpunk » Sat, May 09, 2026, 9:06 PM UTC

This is from April 28th, it was patched in 15.0R-p7.

Re: Local privilege escalation via execve()

#7

Post by pjmlp » Sat, May 09, 2026, 9:07 PM UTC

doublerabbit wrote: post #5

Linux is on their second and FreeBSD is on their first. How many is Windows on?

Plenty, Microsoft has security teams whose job is to attack Windows.

Naturally they don't do blog posts about what they find.

Re: Local privilege escalation via execve()

#8

Post by skydhash » Sat, May 09, 2026, 9:07 PM UTC

itsthefrank wrote: post #3

rvz wrote: post #2

> IV. Workaround > No workaround is available. Oh dear.

> V. Solution > Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Not everyone can just freebsd-update and reboot, so yes, "Oh dear." is a good response to this.

Why can't they? Upgrading and rebooting is kinda the standard response for most security issues. So I would expect something like Ansible's playbooks for this exact scenario. You might also have it setup as a staggered rollout.

Re: Local privilege escalation via execve()

#9

Post by itsthefrank » Sat, May 09, 2026, 9:08 PM UTC

epcoa wrote: post #4

itsthefrank wrote: post #3

Earlier quoted context omitted.

> V. Solution > Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Not everyone can just freebsd-update and reboot, so yes, "Oh dear." is a good response to this.

Anyone relying on a 30+ year old monolith kernel written in C to not have some exploitable LPEs lurking should stay in basket weaving and out of sysadmin.

Not sure why the snark but if people are running FreeBSD then they should be...basket weaving instead of using it? Yes, the correct solution is to patch and reboot but not everyone is in a place to jump and do that which is why a temp workaround, if possible, would be welcome

Re: Local privilege escalation via execve()

#10

Post by dwattttt » Sat, May 09, 2026, 9:09 PM UTC

doublerabbit wrote: post #5

Linux is on their second and FreeBSD is on their first. How many is Windows on?

If you think Linux is on their first or second, I'm not sure how or what you're counting.