Jail Escape via fdescfs nodup Option in FreeBSD

Executive Summary

This vulnerability involves FreeBSD's jail system, which restricts processes to a limited filesystem view. When fdescfs(4) is mounted in a jail with the 'nodup' option, opening /dev/fd/N returns a descriptor that does not inherit FD_RESOLVE_BENEATH or Capsicum capability rights of descriptor N. This allows a process in a jail to escape the filesystem root restriction by receiving a directory file descriptor from another jail.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if fdescfs is mounted with the 'nodup' option in a jail environment. Inspect mounted filesystems with 'mount | grep fdescfs' and verify jail configurations for descriptor passing. No direct commands detect exploitation but confirm if the vulnerable setup exists.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeBSD jails with fdescfs mounted using the 'nodup' option, a malicious process inside a jail could escape its restricted filesystem view. This could allow unauthorized access to files outside the jail, potentially leading to data breaches or system compromise. Only systems passing directory descriptors into jails are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements like GDPR or HIPAA. If an attacker escapes a jail and accesses restricted data, it may result in data breaches, non-compliance with data protection regulations, and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeBSD using pkg, freebsd-update, or source patches to apply fixes for CVE-2026-101304. Reboot the system after patching. Avoid passing directory descriptors into jails if not required. Monitor FreeBSD security advisories for additional updates.

Useful 0 Not Useful 0