FreeBSD 14.5-RC1 Released with a Batch of Security Fixes

The FreeBSD project has unveiled 14.5-RC1 — the last scheduled preview build before the stable release of FreeBSD 14.5, whose debut is expected on September 8. This is the final chance to test the system before its official launch.

The bulk of the changes in the new build consists of security fixes. Beyond those, the “kmods” kernel-module repository now points to packages built for FreeBSD 14.5.

Vulnerabilities Fixed

A race condition has been eliminated in the code that configures large pages for POSIX shared memory: the bug allowed local users to escalate their privileges on the system. The issue was discovered by researchers at GMO Cybersecurity by Ierae.

The same team found a use-after-free vulnerability in the kernel related to TTY ioctl calls — it, too, opened a path to privilege escalation for unprivileged local users.

Another use-after-free bug in the kernel, this time in the sound subsystem (the SNDCTL_DSP_SYNCSTART ioctl), was uncovered at GovTech CSG. It could likewise be used to elevate the privileges of local users.

Alexander Leidinger described a problem in the HWPMC driver, which handles hardware performance counters: the driver did not detach when credentials changed during an exec. As a result, an unprivileged user who had attached PMC counters to a process could keep observing it even after the process launched a setuid or setgid binary.

Finally, the developers pulled in the current OpenSSL code from upstream to pick up fixes for several vulnerabilities in that key project at once.

There are no other significant changes in 14.5-RC1 — the emphasis is specifically on security. The project invites everyone interested to test the release before the stable version makes its debut in early September.

Source: Phoronix