FreeBSD execve(2) TOCTOU Race Local Privilege Escalation CVE-2020-49415

Vulnerability Overview Vulnerability Name: Local privilege escalation via execve(2) TOCTOU race CVE ID: CVE-2020-49415 Publication Date: 2020-06-30 Affected Module: execve Affected Versions: All supported FreeBSD versions (stable/15, 15.1-STABLE, releng/15.1, 15.1-RELEASE-p1, releng/15.8, 15.8-RELEASE-p11, releng/14, 14.4-RELEASE-p12, releng/14.4, 14.4-RELEASE-p7, releng/14.3, 14.3-RELEASE-p16) Impact Scope Background: When the execve(2) system call replaces the image of the calling process, it installs a new virtual address space containing the code and data of the binary file, and then updates the process credentials to match the file owner. Problem Description: When handling SUID binaries during execve(2), the process credentials are updated before the new virtual address space is installed. During this window, processes running under the same user can access the target process's memory via procfs or lproctfs, because the kernel's debug permission check still sees the original credentials. Impact: Unauthorized local users can exploit this race condition to modify the address space of SUID binaries, potentially gaining complete control of the affected system before their credentials are elevated. Remediation No Workaround: No workaround is currently available. Solution: Upgrade to a vulnerability patch available in the FreeBSD stable or release/security branches (releng) after the patch release date, and reboot the system. Specific Steps 1. Update vulnerable systems based on base system packages: - For FreeBSD systems running 15.0-RELEASE or higher, use the pkg(8) utility for updates: 2. Update vulnerable systems based on binary distribution sets: - For FreeBSD systems running RELEASE versions, use the freebsd-update(8) utility for updates: 3. Update vulnerable systems via source code patches: - Download the relevant patch and verify the PGP signature: - Apply the patch: - Rebuild the kernel: Additional Information Fix Details: The issue was resolved with the corresponding Git commit hash; see the table on the page for the specific hash. References: CVE-2020-49415 --- Note: The page does not contain POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

FreeBSD execve(2) TOCTOU Race Local Privilege Escalation CVE-2020-49415