The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=00036dad647ff171b8c1847e92ac74bb511ed9d9
commit 00036dad647ff171b8c1847e92ac74bb511ed9d9 Author: Mark Johnston <[email protected]> AuthorDate: 2026-08-24 18:13:29 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-08-24 19:29:47 +0000 cred: Fix group_is_primary() This helper wasn't updated in commit be1f7435ef21, so in reality it was testing whether "gid" is the first supplemental group. If a user doesn't belong to a supplementary group, then it's testing an uninitialized slot; since ucreds are allocated with M_ZERO, this typically means that we're testing gid == 0. group_is_primary() has exactly one use, in mac_do. There, it's used to determine whether to keep the caller's current primary groups. This means that a rule such as gid=0>uid=0 will permit any credential with no supplementary groups. I believe this is mostly exploitable by daemons which have explicitly dropped privileges and called setgroups(0, NULL); logged in users will have a non-empty supplementary group list by virtue of having gone through initgroups(3). Fix group_is_primary(), and add a regression test. Approved by: so Security: FreeBSD-SA-26:59.mac_do Security: CVE-2026-58092 Reported by: Hazley Samsudin of GovTech CSG Fixes: be1f7435ef21 ("kern: start tracking cr_gid outside of cr_groups[]") Reviewed by: olce, kevans Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59051 --- sys/sys/ucred.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/sys/ucred.h b/sys/sys/ucred.h index 254f58841993..0edd1549b5f6 100644 --- a/sys/sys/ucred.h +++ b/sys/sys/ucred.h @@ -258,7 +258,7 @@ bool cr_xids_subset(struct ucred *active_cred, struct ucred *obj_cred); static inline bool group_is_primary(const gid_t gid, const struct ucred *const cred) { - return (gid == cred->cr_groups[0] || gid == cred->cr_rgid || + return (gid == cred->cr_gid || gid == cred->cr_rgid || gid == cred->cr_svgid); } bool group_is_supplementary(const gid_t gid, const struct ucred *const cred);
