diff --git a/website/content/en/releases/13.5R/relnotes.adoc b/website/content/en/releases/13.5R/relnotes.adoc index bb17482a40..52c0e59df1 100644 --- a/website/content/en/releases/13.5R/relnotes.adoc +++ b/website/content/en/releases/13.5R/relnotes.adoc @@ -1,303 +1,307 @@ --- title: "FreeBSD 13.5-RELEASE Release Notes" sidenav: download --- :releaseCurrent: 13.5-RELEASE :releaseBranch: 13-STABLE :releasePrev: 13.4-RELEASE :releaseNext: 13.5-RELEASE :releaseType: "release" include::shared/en/urls.adoc[] = FreeBSD {releaseCurrent} Release Notes :doctype: article :toc: macro :toclevels: 1 :icons: font == Abstract [.abstract-title] The release notes for FreeBSD {releaseCurrent} contain a summary of the changes made to the FreeBSD base system on the {releaseBranch} development line. This document lists applicable security advisories that were issued since the last release, as well as significant changes to the FreeBSD kernel and userland. Some brief remarks on upgrading are also presented. [[intro]] == Introduction This document contains the release notes for FreeBSD {releaseCurrent}. It describes recently added, changed, or deleted features of FreeBSD. It also provides some notes on upgrading from previous versions of FreeBSD. The {releaseType} distribution to which these release notes apply represents the latest point along the {releaseBranch} development branch since {releaseBranch} was created. Information regarding pre-built, binary {releaseType} distributions along this branch can be found at https://www.FreeBSD.org/releases/[]. The {releaseType} distribution to which these release notes apply represents a point along the {releaseBranch} development branch since {releasePrev}. The {releaseNext} is expected to be the final release from the {releaseBranch} branch. Information regarding pre-built, binary {releaseType} distributions along this branch can be found at https://www.FreeBSD.org/releases/[]. This distribution of FreeBSD {releaseCurrent} is a {releaseType} distribution. It can be found at https://www.FreeBSD.org/releases/[] or any of its mirrors. More information on obtaining this (or other) {releaseType} distributions of FreeBSD can be found in the link:{handbook}/mirrors[Obtaining FreeBSD appendix] to the link:{handbook}/[FreeBSD Handbook]. All users are encouraged to consult the release errata before installing FreeBSD. The errata document is updated with "late-breaking" information discovered late in the release cycle or after the release. Typically, it contains information on known bugs, security advisories, and corrections to documentation. An up-to-date copy of the errata for FreeBSD {releaseCurrent} can be found on the FreeBSD Web site. This document describes the most user-visible new or changed features in FreeBSD since {releasePrev}. In general, changes described here are unique to the {releaseBranch} branch unless specifically marked as MERGED features. Typical release note items document recent security advisories issued after {releasePrev}, new drivers or hardware support, new commands or options, major bug fixes, or contributed software upgrades. They may also list changes to major ports/packages or release engineering practices. Clearly the release notes cannot list every single change made to FreeBSD between releases; this document focuses primarily on security advisories, user-visible changes, and major architectural improvements. [[upgrade]] == Upgrading from Previous Releases of FreeBSD Binary upgrades between RELEASE versions (and snapshots of the various security branches) are supported using the man:freebsd-update[8] utility. See the release-specific upgrade procedure, link:../installation/#upgrade-binary[FreeBSD {releaseCurrent} upgrade information], with more details in the FreeBSD handbook link:{handbook}cutting-edge/#freebsdupdate-upgrade[binary upgrade procedure]. This will update unmodified userland utilities, as well as unmodified GENERIC kernels distributed as a part of an official FreeBSD release. The man:freebsd-update[8] utility requires that the host being upgraded have Internet connectivity. Source-based upgrades (those based on recompiling the FreeBSD base system from source code) from previous versions are supported, according to the instructions in [.filename]#/usr/src/UPDATING#. [IMPORTANT] ==== Upgrading FreeBSD should only be attempted after backing up _all_ data and configuration files. ==== [[security-errata]] == Security and Errata This section lists the various Security Advisories and Errata Notices since {releasePrev}. [[security]] === Security Advisories [.informaltable] [cols="1,1,1", frame="none", options="header"] |=== | Advisory | Date | Topic |https://www.freebsd.org/security/advisories/FreeBSD-SA-24:15.bhyve.asc[FreeBSD-SA-24:15.bhyve] |19 September 2024 |man:bhyve[8] out-of-bounds read access via XHCI emulation |https://www.freebsd.org/security/advisories/FreeBSD-SA-24:16.libnv.asc[FreeBSD-SA-24:16.libnv] |19 September 2024 |Integer overflow in libnv |https://www.freebsd.org/security/advisories/FreeBSD-SA-24:17.bhyve.asc[FreeBSD-SA-24:17.bhyve] |29 October 2024 |Multiple issues in the bhyve hypervisor |https://www.freebsd.org/security/advisories/FreeBSD-SA-24:18.ctl.asc[FreeBSD-SA-24:18.ctl] |29 October 2024 |Unbounded allocation in man:ctl[4] CAM Target Layer |https://www.freebsd.org/security/advisories/FreeBSD-SA-24:19.fetch.asc[FreeBSD-SA-24:19.fetch] |29 October 2024 |Certificate revocation list man:fetch[1] option fails |https://www.freebsd.org/security/advisories/FreeBSD-SA-25:01.openssh.asc[FreeBSD-SA-25:01.openssh] |29 January 2025 |OpenSSH Keystroke Obfuscation Bypass |https://www.freebsd.org/security/advisories/FreeBSD-SA-25:02.fs.asc[FreeBSD-SA-25:02.fs] |29 January 2025 |Buffer overflow in some filesystems via NFS |https://www.freebsd.org/security/advisories/FreeBSD-SA-25:03.etcupdate.asc[FreeBSD-SA-25:03.etcupdate] |29 January 2025 |Unprivileged access to system files |https://www.freebsd.org/security/advisories/FreeBSD-SA-25:04.ktrace.asc[FreeBSD-SA-25:04.ktrace] |29 January 2025 |Uninitialized kernel memory disclosure via man:ktrace[2] + +|https://www.freebsd.org/security/advisories/FreeBSD-SA-25:05.openssh.asc[FreeBSD-SA-25:05.openssh] +|21 February 2025 +|Multiple vulnerabilities in OpenSSH |=== [[errata]] === Errata Notices [.informaltable] [cols="1,1,1", frame="none", options="header"] |=== | Errata | Date | Topic |https://www.freebsd.org/security/advisories/FreeBSD-EN-24:16.pf.asc[FreeBSD-EN-24:16.pf] |19 September 2024 |Incorrect ICMPv6 state handling in pf |https://www.freebsd.org/security/advisories/FreeBSD-EN-24:17.pam_xdg.asc[FreeBSD-EN-24:17.pam_xdg] |29 October 2024 |XDG runtime directory's file descriptor leak at login |https://www.freebsd.org/security/advisories/FreeBSD-EN-25:01.rpc.asc[FreeBSD-EN-25:01.rpc] |29 January 2025 |NULL pointer dereference in the NFSv4 client |https://www.freebsd.org/security/advisories/FreeBSD-EN-25:02.audit.asc[FreeBSD-EN-25:02.audit] |29 January 2025 |System call auditing disabled by DTrace |https://www.freebsd.org/security/advisories/FreeBSD-EN-25:03.tzdata.asc[FreeBSD-EN-25:03.tzdata] |29 January 2025 |Timezone database information update |=== [[userland]] == Userland This section covers changes and additions to userland applications, contributed software, and system utilities. [[userland-config]] === Userland Configuration Changes [[userland-programs]] === Userland Application Changes [[userland-contrib]] === Contributed Software [[userland-deprecated-programs]] === Deprecated Applications [[userland-libraries]] === Runtime Libraries and API [[kernel]] == Kernel This section covers changes to kernel configurations, system tuning, and system control parameters that are not otherwise categorized. [[kernel-general]] === General Kernel Changes [[drivers]] == Devices and Drivers This section covers changes and additions to devices and device drivers since {releasePrev}. [[drivers-device]] === Device Drivers [[drivers-removals]] === Deprecated and Removed Drivers man:agp[4] has been planned for removal in FreeBSD 15.0, and the man page now states that it is deprecated. gitref:8375d2b9c653[repository=src]. [[storage]] == Storage This section covers changes and additions to file systems and other storage subsystems, both local and networked. [[storage-general]] === General Storage Allow to pass {NGROUPS_MAX} + 1 groups in man:mountd[8]. gitref:927d7d57793a[repository=src]. NGROUPS_MAX is just the minimum maximum of the number of allowed supplementary groups. The actual runtime value may be greater. Allow more groups to be specified accordingly. man:nmount[2] has been changed similarly. (Sponsored by The FreeBSD Foundation) [[boot]] == Boot Loader Changes This section covers the boot loader, boot menu, and other boot-related changes. [[boot-loader]] === Boot Loader Changes [[network]] == Networking This section describes changes that affect networking in FreeBSD. [[network-general]] === General Network Convert PF_DEFAULT_TO_DROP into a vnet loader tunable `net.pf.default_to_drop`. gitref:cb162f659578[repository=src]. gitref:7f7ef494f11d[repository=src] introduced a compile time option PF_DEFAULT_TO_DROP to make the man:pf[4] default rule to drop. While this change exposes a vnet loader tunable `net.pf.default_to_drop` so that users can change the default rule without re-compiling the man:pf[4] module. This change is similar to that for IPFW gitref:5f17ebf94db5[repository=src]. Add AIM to man:igc[4] driver. gitref:eaa616f02193[repository=src]. igc is derived from igb and has never had an AIM implementation. The same algorithm from e1000 is appropriate here. The AIM algorithm was re-introduced from the older igb or out of tree driver, and then modernized with permission to use Intel code from other drivers. (Sponsored by Rubicon Communications, LLC/Netgate and BBOX.io) Re-add AIM to e1000 driver. gitref:a527aa7a7f62[repository=src]. (Sponsored by Rubicon Communications, LLC/Netgate and BBOX.io) Old itr sysctl handler has been removed from the e1000 driver. gitref:a42c3e61504b[repository=src]. With the new AIM code, it is expected most users will not need to manually tune this. (Sponsored by BBOX.io) [[hardware]] == Hardware Support This section covers general hardware support for physical machines, hypervisors, and virtualization environments, as well as hardware changes and updates that do not otherwise fit in other sections of this document. Please see link:https://www.freebsd.org/releases/13.5R/hardware[the list of hardware] supported by {releaseCurrent}, as well as link:https://www.freebsd.org/platforms/[the platforms page] for the complete list of supported CPU architectures. [[hardware-virtualization]] === Virtualization Support Teach man:sysctl[8] to attach and run itself in a jail. gitref:5b0a5d8c1ea3[repository=src]. This allows the parent jail to retrieve or set kernel state when child does not have man:sysctl[8] installed (for example light weighted OCI containers or slim jails). This is especially useful when manipulating jail prison or vnet sysctls. For example, `sysctl -j foo -Ja` or `sysctl -j foo net.fibs=2`. Teach man:ip6addrctl[8] to attach and run itself in a jail. gitref:fa9926a62ae3[repository=src]. This will make it easier to manage address selection policies of vnet jails, especially for those light weighted OCI containers or slim jails. Enable vnet man:sysctl[9] variables to be loader tunable. gitref:d2a999c2e0a0[repository=src]. Completes phase two of gitref:3da1cf1e88f8[repository=src]. The meaning of the flag CTLFLAG_TUN is extended to automatically check if there is a kernel environment variable which shall initialize the sysctl during early boot. In memoriam of Hans Petter Selasky. Add flags to filter jail prison and vnet variables via man:sysctl[8]. gitref:09cbd68e4e47[repository=src]. So users do not have to contact the source code to tell whether a variable is a jail prison / vnet one or not. Define a common `mac` node for jail parameters of MAC. gitref:ae2383c0dd16[repository=src]. To be used by MAC/do. (Sponsored by The FreeBSD Foundation) [[documentation]] == Documentation This section covers changes to manual (man:man[1]) pages and other documentation shipped with the base system. [[man-pages]] === Man Pages [[ports]] == Ports Collection and Package Infrastructure This section covers changes to the FreeBSD Ports Collection, package infrastructure, and package maintenance and installation tools. [[ports-packages]] === Packaging Changes [[future-releases]] == General Notes Regarding Future FreeBSD Releases