CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/04/15 12:55:54
Modified files:
sys/kern : kern_fork.c
Log message:
During early stages of fork in process_new(), since the ps_pgrp field is
in the process copy region the child gets this pointer. Before fork1()
completes the process creation, it is possible for other processes to change
the pgrp in an attacker controlled way, such that the pointer becomes stagnant.
A very complicated AI-generated attack chaining many methods (which a
experienced
human could generate given sufficent time) suceeds at racing this stagnant pgrp
object in the pool cache and can do things it should not.
We need to start the children without a pgrp (ie. NULL), and update the
pgrp pointer late.
Found by Nicholas Carlini at Anthropic
this is security errata 7.7/037_pgrp.patch.sig and 7.8/031_pgrp.patch.sig
