unlinkat and funlinkat Path Traversal in FreeBSD Kernel

Executive Summary

This vulnerability affects FreeBSD's unlinkat(2) and funlinkat(2) system calls. The AT_RESOLVE_BENEATH flag is meant to restrict path resolution to prevent accessing directories above a specified starting point. However, the kernel function validates the flag but fails to enforce it, effectively ignoring it during path lookup. This allows processes to resolve and delete files outside the intended directory tree.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your FreeBSD system is running an affected version by running: freebsd-version. If your system is on FreeBSD 14.x or 15.x and has not applied the patch, it is vulnerable. Review system logs for unusual file deletion activity or unauthorized path traversal attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker or malicious process to delete files outside the intended directory tree, potentially causing data loss or system instability. Systems relying on AT_RESOLVE_BENEATH for path containment may be compromised, leading to unauthorized file operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file deletions outside intended directories, potentially violating data integrity and access control requirements in standards like GDPR and HIPAA. Compliance may be affected if systems rely on AT_RESOLVE_BENEATH for confinement of file operations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update your FreeBSD system to a patched version using pkg update && pkg upgrade, freebsd-update fetch install, or apply source code patches. After updating, reboot the system to ensure the kernel changes take effect. No workaround exists other than patching and rebooting.

Useful 0 Not Useful 0