CVE-2026-45257— Arbitrary file overwrite via the KTLS receive path

Arbitrary file overwrite via the KTLS receive path

The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When the sender transmits such data over a loopback connection without enabling KTLS on the transmit side, the file-backed mbufs reach the receiver's decryption path unchanged. Decrypting a record in place then overwrites the backing file's page cache instead of a private copy of the data. An unprivileged local user who can read a file can overwrite its contents with data of their choosing by sending the file over a loopback connection on which they have enabled KTLS receive. The write modifies the page cache directly, so it bypasses file flags such as schg and is written back to disk. By overwriting a setuid binary or other trusted file, a local user can escalate privileges, potentially gaining full control of the affected system.

N/A

任意地址可写任意内容条件

FreeBSD 缓冲区错误漏洞

FreeBSD是FreeBSD基金会开源的一套类Unix操作系统。 FreeBSD存在缓冲区错误漏洞，该漏洞源于KTLS接收路径中假设mbufs是匿名且安全的，但sendfile(2)发送的文件支持内存数据通过非匿名页面到达时，解密会直接覆盖页面缓存，导致无特权用户可覆盖文件内容以提升权限。以下版本受到影响：15.0-RELEASE p10之前版本、14.4-RELEASE p6之前版本和14.3-RELEASE p15之前版本。

N/A

N/A