Re: FreeBSD Security Advisory FreeBSD-SA-26:28.capsicum

Unsubscribe=20

> On 10 Jun 2026, at 00:32, FreeBSD Security Advisories <security-advisories=
@freebsd.org> wrote:
>=20
> =EF=BB=BF-----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>=20
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

> FreeBSD-SA-26:28.capsicum                                   Security Advis=
ory
>                                                          The FreeBSD Proje=
ct
>=20
> Topic:          sigqueue(2) missing capability mode restriction
>=20
> Category:       core
> Module:         capsicum
> Announced:      2026-06-09
> Credits:        Ed Maste
> Affects:        All supported versions of FreeBSD.
> Corrected:      2026-05-29 19:11:40 UTC (stable/15, 15.1-STABLE)
>                2026-06-09 19:20:09 UTC (releng/15.1, 15.1-RC3-p1)
>                2026-06-09 19:19:46 UTC (releng/15.0, 15.0-RELEASE-p10)
>                2026-05-29 19:12:58 UTC (stable/14, 14.4-STABLE)
>                2026-06-09 19:19:08 UTC (releng/14.4, 14.4-RELEASE-p6)
>                2026-06-09 19:18:38 UTC (releng/14.3, 14.3-RELEASE-p15)
> CVE Name:       CVE-2026-45259
>=20
> For general information regarding FreeBSD Security Advisories,
> including descriptions of the fields above, security branches, and the
> following sections, please visit <URL:https://security.FreeBSD.org/>.
>=20
> I.   Background
>=20
> Capsicum is a lightweight OS capability and sandbox framework.  It provide=
s
> two kernel primitives: capability mode, and capabilities.  Capability mode=

> restricts the ability of a sandboxed process to interact with the global
> namespace, including the ability to send signals to other processes, other=

> than via capability-based interfaces.
>=20
> In capability mode, kill(2) restricts signal delivery to the calling proce=
ss
> only, preventing a sandboxed process from signalling other processes.
> sigqueue(2) provides similar signal delivery functionality, and is similar=
ly
> permitted in capability mode.
>=20
> II.  Problem Description
>=20
> sigqueue(2) was marked as permitted in capability mode with the introducti=
on
> of Capsicum in 2011, but the implementation of kern_sigqueue did not inclu=
de
> a capability mode check restricting signal delivery to the calling process=
's
> own PID.
>=20
> III. Impact
>=20
> A process in capability mode can use sigqueue(2) to send signals to any
> process it could signal following standard Unix permissions, bypassing the=

> Capsicum sandbox restriction.  A compromised sandboxed process could
> interfere with other processes, for example by sending SIGKILL or SIGSTOP.=

> This could be any process running as the same user, or any process, for a
> superuser sandboxed process.
>=20
> IV.  Workaround
>=20
> No workaround is available.
>=20
> V.   Solution
>=20
> Upgrade your vulnerable system to a supported FreeBSD stable or
> release / security branch (releng) dated after the correction date, and
> reboot.
>=20
> Perform one of the following:
>=20
> 1) To update your vulnerable system installed from base system packages:
>=20
> Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64
> platforms, which were installed using base system packages, can be updated=

> via the pkg(8) utility:
>=20
> # pkg upgrade -r FreeBSD-base
> # shutdown -r +10min "Rebooting for a security update"
>=20
> 2) To update your vulnerable system installed from binary distribution set=
s:
>=20
> Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platfor=
ms
> which were not installed using base system packages can be updated via the=

> freebsd-update(8) utility:
>=20
> # freebsd-update fetch
> # freebsd-update install
> # shutdown -r +10min "Rebooting for a security update"
>=20
> 3) To update your vulnerable system via a source code patch:
>=20
> The following patches have been verified to apply to the applicable
> FreeBSD release branches.
>=20
> a) Download the relevant patch from the location below, and verify the
> detached PGP signature using your PGP utility.
>=20
> [FreeBSD 15.1]
> # fetch https://security.FreeBSD.org/patches/SA-26:28/capsicum-15.1.patch
> # fetch https://security.FreeBSD.org/patches/SA-26:28/capsicum-15.1.patch.=
asc
> # gpg --verify capsicum-15.1.patch.asc
>=20
> [FreeBSD 15.0]
> # fetch https://security.FreeBSD.org/patches/SA-26:28/capsicum-15.0.patch
> # fetch https://security.FreeBSD.org/patches/SA-26:28/capsicum-15.0.patch.=
asc
> # gpg --verify capsicum-15.0.patch.asc
>=20
> [FreeBSD 14.x]
> # fetch https://security.FreeBSD.org/patches/SA-26:28/capsicum-14.patch
> # fetch https://security.FreeBSD.org/patches/SA-26:28/capsicum-14.patch.as=
c
> # gpg --verify capsicum-14.patch.asc
>=20
> b) Apply the patch.  Execute the following commands as root:
>=20
> # cd /usr/src
> # patch < /path/to/patch
>=20
> c) Recompile your kernel as described in
> <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
> system.
>=20
> VI.  Correction details
>=20
> This issue is corrected as of the corresponding Git commit hash in the
> following stable and release branches:
>=20
> Branch/path                             Hash                     Revision
> - ------------------------------------------------------------------------=
-
> stable/15/                              defd9b86ef99    stable/15-n283744
> releng/15.1/                            871d33e8a66a  releng/15.1-n283553
> releng/15.0/                            77ee83d12625  releng/15.0-n281055
> stable/14/                              d11ff01b3aec    stable/14-n274231
> releng/14.4/                            eab757f954ed  releng/14.4-n273717
> releng/14.3/                            f56e8cb94df6  releng/14.3-n271517
> - ------------------------------------------------------------------------=
-
>=20
> Run the following command to see which files were modified by a
> particular commit:
>=20
> # git show --stat <commit hash>
>=20
> Or visit the following URL, replacing NNNNNN with the hash:
>=20
> <URL:https://cgit.freebsd.org/src/commit/?id=3DNNNNNN>
>=20
> To determine the commit count in a working tree (for comparison against
> nNNNNNN in the table above), run:
>=20
> # git rev-list --count --first-parent HEAD
>=20
> VII. References
>=20
> <URL:https://www.cve.org/CVERecord?id=3DCVE-2026-45259>
>=20
> The latest revision of this advisory is available at
> <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:28.capsicum.asc=
>
> -----BEGIN PGP SIGNATURE-----
>=20
> iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmoolxAbFIAAAAAABAAO
> bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrv9xQQALSpP1xklc9UjGzlSpTo
> 2owWykX02TVDqd7a57jEFpak6F9sJ1B83jrkEQVIGjBGQpTIWYt/C34QEzeo502F
> +dqfqXr32MyudPDq+lsWB7HhafG/gktTDpibJrQkqPDdTc+TwzzhoHxGAdckAMsr
> vCqnUF6UmtmTzQEyoQBqPGPWbVnyVboOQ0ZvKouMZdMBVlC7IvWPDlbpMEOLePTE
> NPHeuxFYbFHMUkOLq97Dhg4XTqdIG0t3n/0jA1kjCDvJWDbXpR1bPy1USTNxHO35
> xjeZshL2IWXDJSxLFBNE+cNFwg4dyp5vXcQXh3HtyMC9PMPMyIbJT7zQluV3CVI7
> 9gC6MMH7QiLssj5hJqMSXccrNzkag6Alu9ET5A/NtoGjyogbXmIPsQ9hLAqf/c9v
> 5m4O86dlHBL/JsGcPqsGw3+gucqgso2gy4yQ8h1GqGwNGv440TMAHRz5eAu+qOZq
> tDxo3OqK3HIEoChiQaRZp5bc/p0L1Rfka10J0HmIxB2KkdHEjdMn5SBsEYRsIv5v
> Sp34rl0cLm0oHraIQ0jNVTwZetrxl4CMIAexHYO1hJ+jZDRdBQ5CC7S83+t2Tbnu
> JgRsm6A+1TZfWsaflIx9ga42DEndXgqpmdrtjIFoO1zNQjrvcd3sqJH6GTMNdywg
> 2woyv6Bb/bwINWDE7EhicoJl
> =3DWJPW
> -----END PGP SIGNATURE-----
>=20