Beat
FreeBSD
FreeBSD OS and ports ecosystem news
FreeBSD 14.4 told builders they had a newer OpenSSL than they did
The base system ships small files that tell other programs which OpenSSL is installed. On 14.4 those files said 3.5.1 while the library on that branch is 3.0.
Some Intel CPUs never got early microcode on FreeBSD
FreeBSD can load Intel CPU microcode very early in boot. A bad bounds check skipped the extra signature table, so some recent Intel chips kept firmware microcode only.
A shared-memory page-size race can escalate privileges
POSIX shared memory can back an object with large pages. Two callers could set the page size at once, leave the object inconsistent, and escalate privileges.
A terminal ioctl race can escalate privileges
The kernel's terminal layer can drop a lock while attaching a controlling terminal. A local user can race that window and escalate privileges.
Base OpenSSL picks up a batch of memory and protocol bugs
FreeBSD ships OpenSSL in the base system. The signed advisory lists a heap overflow, a double free, and remote paths that can exhaust memory, with impact from denial of service up to possible remote code execution.
A credential-switch policy can set the wheel group on FreeBSD 15
mac_do is an optional policy that lets an admin allow some users to switch identity. A leftover group check can apply the wrong primary group, and with some rules that can become wheel.
The sound driver can escalate privileges when two devices start together
The sound driver can start several audio devices at once. With more than one device, a local user could hit a use-after-free and escalate privileges.
A local socket bug can escalate privileges on FreeBSD 15
Unix sockets are how programs on the same machine pass messages and file descriptors. A receive-path bug could free a message and then still use it, and the advisory says a local user can escalate privileges.
Performance counters could keep watching after a privilege jump
Hardware performance counters are meant to drop when a process becomes privileged. A flipped check let an unprivileged watcher keep monitoring after that jump.
FreeBSD's userland PPP daemon overflowed on a crafted peer option
The userland PPP program is the old dial-up and point-to-point helper still in the base system. A peer could send a malformed endpoint option and the daemon would write past its buffers.
FreeBSD stables now ship Expat 2.8.3
FreeBSD's built-in XML parser is the copy of Expat that base tools use as the system XML library. The 14 and 15 stables now ship 2.8.3, which the vendor tagged for an out-of-bounds read that can hang a 16-bit-character build.
FreeBSD's built-in DNS resolver is now Unbound 1.26.0
FreeBSD moved its built-in DNS resolver to Unbound 1.26.0 on the 14 and 15 stables and on 14.5-BETA. The vendor notes name a heap write and a heap use-after-free.
FreeBSD 14.5-BETA2 is on the release branch
Testers can build 14.5-BETA2 off the release branch. The same window backed out a header change that would have broken the ABI, and announce mail is not up yet.