FreeBSD Kernel CVE-2020-45257 Critical Local Privilege Escalation via sendfile Page Cache Write Primitive

Vulnerability Overview Bumsrakete is an extremely severe kernel vulnerability in FreeBSD, described as "the largest FreeBSD page cache write primitive in history." This vulnerability allows any unprivileged user on a default FreeBSD 13.0 system (amd64, arm64, riscv architectures) to write attacker-controlled bytes into the page cache of any file via the system call. This flaw bypasses all normal file permissions, mount options, and checks. Impact Scope Attack Vector: Local (any logged-in user, no special group membership required) Attack Complexity: Low (requires only a C file and two system calls, no race conditions needed) Required Privileges: None (uid 1001 is sufficient) User Interaction: None Scope of Impact: Changed (page cache write → any SUID-root binary → root) Integrity Impact: High (every readable file is now writable by the attacker) Confidentiality Impact: High (via Local Privilege Escalation) Availability Impact: High (a root shell can arbitrarily crash any program) chflags schg Respect: Bypassed Remediation Patch Available: The advisory mentions that a patch is available, but the specific patch content is not provided. CVE Identifier: CVE-2020-45257 FreeBSD-SA-20:26.ktls: Released Technical Details 1. sendfile(2) generates vnode-backed EXTPG mbufs - Code Example: 2. TCP_KTLS_ENABLE does not check privileges - Code Example: 3. Decryption runs in-place via PHYS_TO_DMAP - Code Example: Exploit Code Construction: - The online ciphertext is the content delivered by , i.e., the current bytes of the file. The receiver's AES-GCM decryption calculates . We choose K and IV, so we know the result. To obtain a valid GMAC tag for the online ciphertext, we encrypt , such that produces and the correct tag. - Code Example: Summary Bumsrakete is an extremely severe FreeBSD kernel vulnerability that allows unprivileged users to write attacker-controlled bytes into the page cache of any file via the system call. This vulnerability bypasses all normal file permissions and checks, affecting integrity, confidentiality, and availability broadly. A patch has been released, although the specific patch content was not provided. The exploit code demonstrates how to leverage this vulnerability by constructing specific ciphertext and keys.

Goal Reached Thanks to every supporter — we hit 100%!

FreeBSD Kernel CVE-2020-45257 Critical Local Privilege Escalation via sendfile Page Cache Write Primitive