Differential D59126

tty: Revalidate after dropping the tty lock in ioctl handlers
ClosedPublic
Actions

Authored by markj on Aug 23 2026, 2:30 PM.

Tags

None

Referenced Files

	F175661720: D59126.diff
	Mon, Oct 12, 8:41 AM

	F175536535: D59126.id.diff
	Sun, Oct 11, 1:32 PM

	Unknown Object (File)
	Sat, Oct 10, 7:06 AM

	Unknown Object (File)
	Thu, Oct 8, 2:33 AM

	Unknown Object (File)
	Wed, Oct 7, 6:04 AM

	Unknown Object (File)
	Tue, Oct 6, 7:28 PM

	Unknown Object (File)
	Fri, Oct 2, 2:32 PM

	Unknown Object (File)
	Wed, Sep 30, 11:29 AM

View All 91 Files

Subscribers

Details

Reviewers

kib
kevans

Group Reviewers

Commits

rGd7883b84b1e1: tty: Revalidate after dropping the tty lock in ioctl handlers
rGb936c3417027: tty: Revalidate after dropping the tty lock in ioctl handlers
rG1aefa1fab9b5: tty: Revalidate after dropping the tty lock in ioctl handlers
rG45a190c827e4: tty: Revalidate after dropping the tty lock in ioctl handlers
rG6269b9bce0e3: tty: Revalidate after dropping the tty lock in ioctl handlers
rGc7cec6fa6e4a: tty: Revalidate after dropping the tty lock in ioctl handlers
rGb207f754c770: tty: Revalidate after dropping the tty lock in ioctl handlers

Summary

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the
proctree relock. After relocking the tty, it did not revalidate the
tty state, and it could end up linking a doomed tty to the calling
process' session. This race can be exploited to escalate privileges.

TIOCSPGRP has a similar race, fix that too.

Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

markj created this revision.Aug 23 2026, 2:30 PM

markj held this revision as a draft.

Herald added subscribers: olce, imp. · View Herald TranscriptAug 23 2026, 2:30 PM

Harbormaster completed remote builds in B75981: Diff 184790.Aug 23 2026, 2:30 PM

markj published this revision for review.Aug 23 2026, 2:31 PM

markj changed the visibility from "Public (No Login Required)" to "Subscribers".

markj changed the edit policy from "All Users" to "Subscribers".

markj added reviewers: kib, kevans, secteam.

markj removed subscribers: imp, olce.

markj added subscribers: kib, kevans, secteam.

This is fine, but I think that we can avoid the trouble by locking the proctree_lock around the ioctl handler instead. Please see D59132

markj abandoned this revision.Aug 23 2026, 10:52 PM

I believe this is fine for the next batch, my patch requires more work.
[Cannot accept due to the review state]

markj reclaimed this revision.Aug 24 2026, 2:25 PM

kib accepted this revision.Aug 24 2026, 2:27 PM

This revision is now accepted and ready to land.Aug 24 2026, 2:27 PM

Closed by commit rGb207f754c770: tty: Revalidate after dropping the tty lock in ioctl handlers (authored by markj). · Explain WhyAug 25 2026, 4:00 PM

This revision was automatically updated to reflect the committed changes.

markj added a commit: rGb207f754c770: tty: Revalidate after dropping the tty lock in ioctl handlers.

markj added a commit: rGc7cec6fa6e4a: tty: Revalidate after dropping the tty lock in ioctl handlers.

markj added a commit: rG6269b9bce0e3: tty: Revalidate after dropping the tty lock in ioctl handlers.

markj added a commit: rG45a190c827e4: tty: Revalidate after dropping the tty lock in ioctl handlers.

markj added a commit: rG1aefa1fab9b5: tty: Revalidate after dropping the tty lock in ioctl handlers.

markj added a commit: rGb936c3417027: tty: Revalidate after dropping the tty lock in ioctl handlers.Aug 25 2026, 4:02 PM

markj added a commit: rGd7883b84b1e1: tty: Revalidate after dropping the tty lock in ioctl handlers.Aug 25 2026, 4:07 PM

markj changed the visibility from "Subscribers" to "Public (No Login Required)".Aug 25 2026, 5:59 PM

markj changed the edit policy from "Subscribers" to "All Users".

Revision Contents
Changeset List

Path

Size

sys/

kern/

14 lines

Diff 185040

sys/kern/tty.c

Loading...