FreeSenseFreeSenseSecurity
freesense.org
← Fixed vulnerabilities
Fixed

Jail escape by a privileged user via nullfs

FreeBSD-SA-26:02.jail · CVE-2025-15547

Our decision for FreeSense

FreeBSD corrected this on 2025-06-30, before the FreeBSD source pin of every FreeSense version.

  • Advisory: corrected 2025-06-30
  • FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
  • FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
  • FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
Decided by rules, not yet reviewed. The status comes from the advisory's correction date and the build configuration. A maintainer has not looked at whether FreeSense is exposed in practice. How we triage

By FreeSense version

VersionStatusFreeBSD pin
FreeSense 1.01.0.7 · frozen, no further fixesFixedFreeBSD pin of 2026-08-032026-08-03e004ff15
FreeSense 1.11.1.9FixedFreeBSD pin of 2026-10-042026-10-04a52c50b4
FreeSense 1.21.2.0-DEVELOPMENTFixedFreeBSD pin of 2026-10-042026-10-04a52c50b4

Workaround

No workaround is available. Jails not created with the allow.mount.nullfs option are unaffected.

What FreeBSD says

By default, jailed processes cannot mount filesystems, including nullfs(4). However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks. If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic allows that user to escape the jail's chroot, yielding access to the full filesystem of the host or parent jail.

Impact

In a jail configured to allow nullfs(4) mounts from within the jail, the jailed root user can escape the jail's filesystem root.

Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.

Copied to clipboard