FreeBSD SA-20:39 Linuxulator Privilege Escalation via setuid Binary (CVE-2020-49413)

Vulnerability Overview Title: FreeBSD-SA-20:39.linux Topic: Vulnerability in the execution of setuid and setgid binaries in the Linux kernel Category: Core Module: Linux Advisory Date: 2020-06-09 Impact: All supported FreeBSD versions Fix Date: 2020-06-09 19:17:31 UTC (stable/15, 15.1-STABLE) to 2020-06-09 19:18:40 UTC (releng/14.3, 14.3-RELEASE-p15) CVE Number: CVE-2020-49413 Impact Scope Background: FreeBSD provides a Linux syscall emulation layer that allows unmodified Linux binaries to run on FreeBSD. Issue Description: When the kernel executes a set-user-ID or set-group-ID Linux binary, it passes the AT_SECURE flag in the ELF auxiliary vector to disable dangerous features. However, when the Linux kernel checks the P_SUGID process flag, this flag is not yet set during the construction of the auxiliary vector, resulting in AT_SECURE being incorrectly set to zero. Impact: Unauthorized local users can gain the privileges of the set-user-ID or set-group-ID Linux binary by injecting shared libraries into it. Remediation 1. Upgrade the System: Upgrade to a supported FreeBSD stable or release/security branch (releng), and restart the system after the fix date. 2. Update Base System Packages: - For version 15.0-RELEASE installed on amd64 or arm64 platforms, use the tool to update. - For RELEASE versions installed on amd64 or arm64 platforms, use the tool to update. 3. Apply Source Code Patch: - Download and verify the patch file. - Apply the patch and recompile the kernel. POC Code / Exploit Code No specific POC code or exploit code was included in the page. References FreeBSD Security Advisory CVE-2020-49413 --- Note: The above information is summarized based on the provided webpage screenshot content.

Goal Reached Thanks to every supporter — we hit 100%!

FreeBSD SA-20:39 Linuxulator Privilege Escalation via setuid Binary (CVE-2020-49413)