FreeBSD TIOCNOTTY Ioctl Use-After-Free Vulnerability Leading to Privilege Escalation

A use-after-free vulnerability has been identified in the FreeBSD kernel's TIOCNOTTY ioctl handler, affecting all supported FreeBSD versions. The issue arises because the handler fails to remove a back-pointer from the terminal structure to the session of the calling process. As a result, when the process exits, the terminal structure may reference freed memory. This dangling pointer can be exploited by a malicious process to gain root privileges.

Impact

Exploitation of this vulnerability allows a process to escalate privileges to root.

Remediation

Users can upgrade to a supported FreeBSD stable or release branch dated after the correction date and reboot the system. Instructions for updating via the pkg utility, freebsd-update utility, or by applying a source code patch are available in the FreeBSD Security Advisory.