Re: FreeBSD Security Advisory FreeBSD-SA-26:26.ktls [REVISED]

On Wed, 17 Jun 2026 16:41:26 +0000 (UTC)
FreeBSD Security Advisories <[email protected]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>=20
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
> FreeBSD-SA-26:26.ktls                                       Security Advi=
sory
>                                                           The FreeBSD Pro=
ject
>=20
> Topic:          Arbitrary file overwrite via the KTLS receive path
>=20
> Category:       core
> Module:         ktls
> Announced:      2026-06-09
> Credits:        Bumsrakete
> Affects:        All supported versions of FreeBSD
> Corrected:      2026-06-09 19:17:28 UTC (stable/15, 15.1-STABLE)
>                 2026-06-09 19:20:06 UTC (releng/15.1, 15.1-RC3-p1)
>                 2026-06-09 19:19:43 UTC (releng/15.0, 15.0-RELEASE-p10)
>                 2026-06-09 19:17:46 UTC (stable/14, 14.4-STABLE)
>                 2026-06-09 19:19:05 UTC (releng/14.4, 14.4-RELEASE-p6)
>                 2026-06-09 19:18:35 UTC (releng/14.3, 14.3-RELEASE-p15)
> CVE Name:       CVE-2026-45257
>=20
> For general information regarding FreeBSD Security Advisories,
> including descriptions of the fields above, security branches, and the
> following sections, please visit <URL:https://security.FreeBSD.org/>.
>=20
> 0. Revision History
>=20
> v1.0 -- Initial revision
> v1.1 -- Update workaround section
>=20
> I.   Background
>=20
> Kernel TLS (KTLS) moves Transport Layer Security (TLS) record processing
> into the kernel, allowing applications to encrypt and decrypt socket data
> without copying it to and from userspace and to serve TLS data with
> sendfile(2).  When a connection uses software KTLS on the receive path,
> the kernel decrypts each incoming TLS record in place within the socket
> buffer.
>=20
> II.  Problem Description
>=20
> The KTLS receive path decrypted each record in place, assuming that the
> mbufs holding received data were anonymous and safe to modify.  This
> assumption does not hold for data placed on a socket by sendfile(2),
> which can reference file-backed memory directly through non-anonymous
> M_EXTPG pages or EXT_SFBUF mbufs.  When the sender transmits such data
> over a loopback connection without enabling KTLS on the transmit side,
> the file-backed mbufs reach the receiver's decryption path unchanged.
> Decrypting a record in place then overwrites the backing file's page
> cache instead of a private copy of the data.
>=20
> III. Impact
>=20
> An unprivileged local user who can read a file can overwrite its
> contents with data of their choosing by sending the file over a loopback
> connection on which they have enabled KTLS receive.  The write modifies
> the page cache directly, so it bypasses file flags such as schg and is
> written back to disk.  By overwriting a setuid binary or other trusted
> file, a local user can escalate privileges, potentially gaining full
> control of the affected system.
>=20
> IV.  Workaround
>=20
> Set sysctl kern.ipc.tls.enable=3D0 to disable KTLS entirely.
>=20
> V.   Solution
>=20
> Upgrade your vulnerable system to a supported FreeBSD stable or
> release / security branch (releng) dated after the correction date,
> and reboot the system.
>=20
> Perform one of the following:
>=20
> 1) To update your vulnerable system installed from base system packages:
>=20
> Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64
> platforms, which were installed using base system packages, can be updated
> via the pkg(8) utility:
>=20
> # pkg upgrade -r FreeBSD-base
> # shutdown -r +10min "Rebooting for a security update"
>=20
> 2) To update your vulnerable system installed from binary distribution se=
ts:
>=20
> Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platfo=
rms
> which were not installed using base system packages can be updated via the
> freebsd-update(8) utility:
>=20
> # freebsd-update fetch
> # freebsd-update install
> # shutdown -r +10min "Rebooting for a security update"
>=20
> 3) To update your vulnerable system via a source code patch:
>=20
> The following patches have been verified to apply to the applicable
> FreeBSD release branches.
>=20
> a) Download the relevant patch from the location below, and verify the
> detached PGP signature using your PGP utility.
>=20
> # fetch https://security.FreeBSD.org/patches/SA-26:26/ktls.patch
> # fetch https://security.FreeBSD.org/patches/SA-26:26/ktls.patch.asc
> # gpg --verify ktls.patch.asc
>=20
> b) Apply the patch.  Execute the following commands as root:
>=20
> # cd /usr/src
> # patch < /path/to/patch
>=20
> c) Recompile your kernel as described in
> <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
> system.
>=20
> VI.  Correction details
>=20
> This issue is corrected as of the corresponding Git commit hash in the
> following stable and release branches:
>=20
> Branch/path                             Hash                     Revision
> - -----------------------------------------------------------------------=
--
> stable/15/                              a51345704403    stable/15-n283882
> releng/15.1/                            48c1c5e3c348  releng/15.1-n283550
> releng/15.0/                            540a315cdb46  releng/15.0-n281052
> stable/14/                              333bdd7e9427    stable/14-n274311
> releng/14.4/                            d43259dd66b3  releng/14.4-n273714
> releng/14.3/                            af3398862ac0  releng/14.3-n271514
> - -----------------------------------------------------------------------=
--
>=20
> Run the following command to see which files were modified by a
> particular commit:
>=20
> # git show --stat <commit hash>
>=20
> Or visit the following URL, replacing NNNNNN with the hash:
>=20
> <URL:https://cgit.freebsd.org/src/commit/?id=3DNNNNNN>
>=20
> To determine the commit count in a working tree (for comparison against
> nNNNNNN in the table above), run:
>=20
> # git rev-list --count --first-parent HEAD
>=20
> VII. References
>=20
> <URL:https://www.cve.org/CVERecord?id=3DCVE-2026-45257>
>=20
> The latest revision of this advisory is available at
> <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:26.ktls.asc>
> -----BEGIN PGP SIGNATURE-----
>=20
> iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmoyuewbFIAAAAAABAAO
> bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvze8P/RRvp3TUprrxMgg4prj6
> Mv7sglMFvwyVPGJstM0zBV2k+seMm8S5QmJtO+m8N5NHAIyJWL6PzvMFE9klI/IC
> g8Jov8lcEcAml0G+xJFCPeeG0fYszqtE8/gxGNdatDv01AnMoFnVMUyy4y1QpSyo
> kJzymPs49LysxggffSmPgmX446hEo7pZ6iQLBuEc0XKNN/7LYmiYq6kcVLzTpkRa
> kfYwsJphWZkfdR2AVzCSxMiMb9D/NQ7WN96B3o+xYX8XoHgrsQmvZ2YrvRf9nyRs
> lgAm9QxlkTcWlwPrNoacg2sN/jZFb3k01GRJAFbcKbDP1t3lkFygD+UHNnlStO+s
> hb5fKHgQgrUpX7atsD2UQ2W+irca0ejLhflxxvgY7pRTLnnmJ20fXDhDn2sWb7zs
> cPxir+4bJk4IZvomK0raFH5eMeJ434/rfkMjfE87WOEryFHabnGsiH9xO2u6+ADT
> UhMl4iBY+wOoaHTTqfpOQpAk2/gO7UUvXtbOkEa8SYZjSQAxMAz7nqyL7Lucix9n
> 7ES4hLmic87cr7+q+8iwvASvcNjlDxqyGYRoLa2+TECsTmKqVbwEEANcufNKemb+
> aPoRFi5apShhwe1kl7/vVCDGPtCssRRYZ+ejwpQY6m4PpRKY9soNFUt2WjOGVmaB
> iQR9r08fcX9SuW2dTuTzXLEi
> =3Dwfi1
> -----END PGP SIGNATURE-----
>=20
I try to update and got:

"freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 15.0-RELEASE from update2.freebsd.org... do=
ne.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

No updates needed to update system to 15.0-RELEASE-p10."

Is it okay, please?

Thank you.

--=20
=E2=80=9CSome people talk in their sleep. Lecturers talk while other people=
 sleep=E2=80=9D
=E2=80=95 Albert Camus=20