diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-04-22 17:58:35 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-04-28 15:46:24 +0000 |
| commit | d619e3a3c0ecf1cda9d41d3aea2e424eb0ccfd89 (patch) | |
| tree | b337686fb1e30dfcafdae5f6e8c04c630dfa5be2 | |
| parent | 2a32297a6d9f0c82e64d315239693fcf4bc7bc23 (diff) | |
execve: Fix an operator precedence bug
The buggy version allowed userspace to overflow the copy into adjacent
execve KVA regions, which enables, among other things, injecting
environment variables into privileged processes.
Approved by: so
Security: FreeBSD-SA-26:13.exec
Security: CVE-2026-7270
Reported by: Ryan Austin of Calif.io
Reviewed by: brooks, kib
Fixes: f373437a01a3 ("Add helper functions to copy strings into struct image_args.")
Differential Revision: https://reviews.freebsd.org/D56665
| -rw-r--r-- | sys/kern/kern_exec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index e8e3d8d8801d..2886965172c9 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -1669,7 +1669,7 @@ exec_args_adjust_args(struct image_args *args, size_t consume, ssize_t extend) if (args->stringspace < offset) return (E2BIG); memmove(args->begin_argv + extend, args->begin_argv + consume, - args->endp - args->begin_argv + consume); + args->endp - (args->begin_argv + consume)); if (args->envc > 0) args->begin_envv += offset; args->endp += offset; |