14 matches found
CVE-2026-101304
When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...
CVE-2026-101304 Multiple jail filesystem root escapes
When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...
CVE-2026-101304 Multiple jail filesystem root escapes
When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...
CVE-2026-101304
When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...
EUVD-2026-101865
When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...
CVE-2026-101304
The FreeBSD operating system is vulnerable to a multiple jail filesystem root escape due to three flaws in how file descriptors are handled. Specifically, when fdescfs(4) is mounted in a jail with the "nodup" option, opening /dev/fd/N returns a descriptor that fails to inherit FD_RESOLVE_BENEATH ...
CVE-2026-101304: Improper Check for Dropped Privileges
When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...
FreeBSD -- Multiple jail filesystem root escapes
Problem Description: Three flaws allow a jailed process to bypass FDRESOLVEBENEATH: When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. CVE-2026-101304 renamea...
FreeBSD-SA-26:66.jail
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:66.jail Security Advisory The FreeBSD Project Topic: Multiple jail filesystem root escapes Category: core Module: jail Announced: 2026-09-29 Credits: Jan...
CVE-1999-0724
Buffer overflow in OpenBSD procfs and fdescfs file systems via uiooffset in the readdir function...
CVE-1999-0724
Summary: CVE-1999-0724 describes a buffer overflow in OpenBSD’s procfs and fdescfs file systems caused by the uio_offset value used by readdir(). The connected Red Hat and CVE records reiterate this description. The affected components are the OpenBSD procfs and fdescfs implementations; no additi...
CVE-1999-0724
Buffer overflow in OpenBSD procfs and fdescfs file systems via uiooffset in the readdir function...