Get a Quote   (408) 943-4100               TrueNAS Discord      VendOp_Icon_15x15px   Commercial Support
TrueNAS.com Software Systems Company Community Security iX Portal Download

FreeBSD kernel
OS

Versions Affected : All verisons prior to FreeNAS 11.3-U4.1

Description

When handling a 32-bit sendmsg(2) call, the compat32 subsystem copies the control message to be transmitted (if any) into kernel memory, and adjusts alignment of control message headers.

The code which performs this work contained a time-of-check to time-of-use (TOCTOU) vulnerability which allows a malicious userspace program to modify control message headers after they were validated by the kernel. The TOCTOU bug can be exploited by an unprivileged malicious userspace program to trigger privilege escalation.

Workaround

No workaround is available.

Mitigation

  • Upgrade to FreeNAS 11.3-U5 or later.

Commit

Further information