diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-05-29 21:41:35 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-06-09 19:13:21 +0000 |
| commit | d39be1b1b50df91ad7ab62b25a4a30343e94cba5 (patch) | |
| tree | 31b3fb844d0cc1cb0cf257960cc0b904447d0990 | |
| parent | 1bac7df1baebd233d31d086a973a48df18f99e73 (diff) | |
linux: Correct the issetugid check in copyout_auxargs
The runtime linker in glibc relies on the AT_SECURE auxv entry to know
whether the executable is set-ugid, if so then various dangerous
functionality such as LD_PRELOAD is disabled.
The check added in commit 669414e4fb74 failed to take into account the
fact that during execve, P_SUGID may not yet be set for a set-ugid
process. Correct the test.
Approved by: so
Security: FreeBSD-SA-26:30.linux
Security: CVE-2026-49413
Reported by: Minseong Kim
Fixes: 669414e4fb74 ("Implement AT_SECURE properly.")
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57350
| -rw-r--r-- | sys/compat/linux/linux_elf.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/sys/compat/linux/linux_elf.c b/sys/compat/linux/linux_elf.c index c9eb6aea8373..6c9f785c97e7 100644 --- a/sys/compat/linux/linux_elf.c +++ b/sys/compat/linux/linux_elf.c @@ -492,11 +492,9 @@ __linuxN(copyout_auxargs)(struct image_params *imgp, uintptr_t base) struct thread *td = curthread; Elf_Auxargs *args; Elf_Auxinfo *aarray, *pos; - struct proc *p; int error, issetugid; - p = imgp->proc; - issetugid = p->p_flag & P_SUGID ? 1 : 0; + issetugid = imgp->credential_setid ? 1 : 0; args = imgp->auxargs; aarray = pos = malloc(LINUX_AT_COUNT * sizeof(*pos), M_TEMP, M_WAITOK | M_ZERO); |