Jail filesystem escape via renameat(2) misuse

Executive Summary

This vulnerability involves FreeBSD's jail system, which restricts processes to a limited filesystem view. The renameat(2) system call did not properly enforce the FD_RESOLVE_BENEATH restriction on directory arguments. A jailed process could exploit this to rename a directory relative to a restricted descriptor and escape the jail root using fchdir(2). This requires the directory to be on a filesystem accessible from the jail's root.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your FreeBSD system is running a vulnerable version and if directory descriptors are being passed into jails. Review the jail configuration and file descriptor handling in fdescfs. No specific commands are provided in the advisory for detection beyond verifying system versions and configurations.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeBSD jails, a malicious process inside a jail could escape its restricted filesystem view. This could allow unauthorized access to files outside the jail, potentially compromising system security. Exploitation requires the attacker to receive a directory file descriptor from another jail.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements like GDPR or HIPAA that mandate strict data isolation and access controls. A jail escape could expose sensitive data, resulting in regulatory penalties or breaches of confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade your FreeBSD system using pkg, freebsd-update, or source patches to apply the fixes for CVE-2026-101305. Reboot the system after applying patches. Ensure that directory descriptors are not passed into jails, as systems not doing so are not at risk.

Useful 0 Not Useful 0