7 matches found
CVE-2026-101305
renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...
CVE-2026-101306
SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...
CVE-2026-101306
This vulnerability affects all supported versions of FreeBSD . The SCM_RIGHTS file descriptor passing mechanism fails to preserve the FD_RESOLVE_BENEATH flag when a descriptor is transferred. An attacker can exploit this by sending a directory file descriptor to themselves over a Unix domain sock...
EUVD-2026-101867
SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...
CVE-2026-101305 Multiple jail filesystem root escapes
renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...
EUVD-2026-101866
renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...
FreeBSD : FreeBSD -- Multiple jail filesystem root escapes (1fe3495b-bccd-11f1-906f-bc241121aa0a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1fe3495b-bccd-11f1-906f-bc241121aa0a advisory. Three flaws allow a jailed process to bypass FDRESOLVEBENEATH: A process in a jail that has...