FreeBSD 14.x Kernel LPE Vulnerability: FatGid Exploit Details
By
WhyNotHugo
10d ago· 6 min readenInsight
75/100
Toasty
Bagelometer↗
Not artisan, but a perfectly fine bagel. Hits the spot.
Score75TypeanalysisSentimentnegative
Summary
This article details a Local Privilege Escalation (LPE) vulnerability in the FreeBSD 14.x kernel, specifically in the kern_setcred_copyin_supp_groups() function within sys/kern/kern_prot.c. The vulnerability involves a type confusion issue where a double pointer (gid_t **) is used for groups, leading to a four-byte type being treated with an eight-byte stride, which can be exploited by an unprivileged user to gain a root shell. The exploit chain works on FreeBSD 14.4-RELEASE-p3 amd64 with the current patchset.
Key quotes
· 3 pulledFull chain on FreeBSD 14.4-RELEASE-p3 amd64 (current patchset).
Unprivileged user, build, run, root shell.
Because groups has type gid_t **, the expression sizeof
A four-byte type, an eight-byte stride, one root shell.
