sysvsem: Fix a TOCTOU race in semctl({GET,SET}ALL)

These commands take a snapshot of the size of a semaphore set, then drop
the lock and malloc an appropriately sized array before reacquiring the
lock.  A comment explains why this is (probably) safe.  Unfortunately,
it's wrong; it is indeed possible for a malicious userspace to create
and destroy 2^{15} sets in the window where the lock is dropped.  This
race can lead to out-of-bounds reads and writes, and that can be
exploited to elevate privileges.

Replace the assertions with runtime checks.

Approved by:	so
Security:	FreeBSD-SA-26:54.sysvsem
Security:	CVE-2026-58087
Reported by:	Maik Muench of Secfault Security
Reviewed by:	kib
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D58421

0 files changed, 0 insertions, 0 deletions