FreeSenseFreeSenseSecurity
freesense.org
← Fixed vulnerabilities
Fixed

Flaw in Linuxulator execution of setugid binaries

FreeBSD-SA-26:30.linux · CVE-2026-49413

Our decision for FreeSense

FreeBSD corrected this on 2026-06-09, before the FreeBSD source pin of every FreeSense version.

  • Advisory: corrected 2026-06-09
  • FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
  • FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
  • FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
Decided by rules, not yet reviewed. The status comes from the advisory's correction date and the build configuration. A maintainer has not looked at whether FreeSense is exposed in practice. How we triage

By FreeSense version

VersionStatusFreeBSD pin
FreeSense 1.01.0.7 · frozen, no further fixesFixedFreeBSD pin of 2026-08-032026-08-03e004ff15
FreeSense 1.11.1.9FixedFreeBSD pin of 2026-10-042026-10-04a52c50b4
FreeSense 1.21.2.0-DEVELOPMENTFixedFreeBSD pin of 2026-10-042026-10-04a52c50b4

Workaround

No workaround is available. Systems that do not have either linux.ko or linux64.ko loaded, or which do not have any Linux executables with the set-uid or set-gid bits set, are not affected.

What FreeBSD says

The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to zero for set-user-ID and set-group-ID executables.

Impact

An unprivileged local user can inject a shared library via LD_PRELOAD into a set-user-ID or set-group-ID Linux binary, gaining the privileges of that binary.

Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.

Copied to clipboard