Signal Permission Bypass in FreeBSD Kernel

Executive Summary

This vulnerability exists in the FreeBSD system call thr_kill2(2), which is used to deliver signals to specific threads within a process. The problem is that the system call calls a permission check function (p_cansignal()) to verify if the signal delivery is allowed, but it does not check the result of this permission verification before sending the signal. Consequently, the signal is delivered even if the permission check fails.

An unprivileged local user who knows or can guess the target process and thread IDs can exploit this flaw to send signals to processes they normally would not have permission to signal, including those owned by other users or root, and processes in different jails. Thread IDs are globally and sequentially allocated, making them discoverable by brute force without needing visibility into the target.

This can allow an attacker to stop or terminate arbitrary processes, including critical system daemons, potentially causing a Denial of Service (DoS).

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the thr_kill2(2) system call improperly delivering signals to threads without proper permission checks. Detection involves identifying if unprivileged users are able to send signals to processes they normally cannot signal.

Since the vulnerability requires knowledge or guessing of process and thread IDs, and thread IDs are allocated globally and sequentially, detection could involve monitoring unusual signal delivery patterns or unexpected process terminations.

However, the advisory does not provide specific detection commands or tools.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unprivileged local attacker to send signals to and potentially stop or terminate arbitrary processes on the system, including critical system daemons.

The impact includes the possibility of causing a Denial of Service (DoS) by disrupting essential services or processes that are normally protected from such interference.

Additionally, because the vulnerability bypasses jail boundaries, an attacker in a jailed environment could affect processes on the host or in other jails, increasing the scope of potential damage.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

The FreeBSD Project has released patches that fix this vulnerability by correcting the permission check in the thr_kill2(2) system call.

Immediate mitigation steps include upgrading your FreeBSD system to a supported stable or release/security branch dated after June 9, 2026.

After applying the update, reboot the system to ensure the patch is active.

Workarounds are not available, so applying the official patches is the only effective mitigation.

Useful 0 Not Useful 0