[Bug 295485] need a way to block zfs.ko from being autoloaded by tools like puppet and facter (FatGID Vuln / CVE-2026-45250)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295485

--- Comment #18 from Olivier Certner <[email protected]> ---
Complement:

The vulnerability website mentions a gadget in zfs.ko needed for privilege
escalation.  It's likely it exists in other parts of the kernel as well, so not
loading zfs.ko will not protect you (and, anyway, even without gadgets, a user
can trigger a panic).  The only real stopgap measure is to upgrade your kernel
(or patch it by hand if no more supported; the patch is trivial and the piece
of code it touches has not changed; there's absolutely zero risk in doing
that).

It's certainly a sane defensive measure not to load what you don't need.  If
kernel modules are loaded through devmatch (not the case of zfs.ko, obviously,
but for the record), you can set 'devmatch_enable' to NO in /etc/rc.conf (or
related) or use 'devmatch_blacklist'.  For kernel modules loaded via
kldload(8), however, there's no other existing measure (AFAIK) than hiding the
modules, either by removing the files directly (not recommended; has drawbacks
as Dan noted) or by changing the module search path (see, e.g., kldconfig(8))
and preparing your own directories containing only links to modules you allow
(or just emptying the search path if no modules are allowed to be loaded). 
That's for the administator side if you don't want/are not able to patch your
ports/programs calling kldload(8).

-- 
You are receiving this mail because:
You are the assignee for the bug.