From nobody Wed May 20 22:24:17 2026 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gLR0f3g5mz6fXcQ for ; Wed, 20 May 2026 22:24:18 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2610:1c1:1:6074::16:84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "freefall.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gLR0f0Wghz4N2b; Wed, 20 May 2026 22:24:18 +0000 (UTC) (envelope-from security-advisories@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779315858; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=Gp0CJwCAZmWwGY02xpa4GKUuVJ/1WAyq11ytkeNaCx8=; b=LxkpAtwZ3M/DyyX+GhS7HNxqUe2lpi0GMyn6fK2H1Z8Yn3pKEs7Nfy2tzekaO3cwQZRxfI pNARtOqcGgXQOn9EVnXFD29Ymb7ufewKqBTsMMVcoxyjcxuLSS1FBMMlCw9i22UhGUqJJ8 yFo9/c4cBW8E6+YfGMvuLe1NPu8BfiDe/COkjZuq2dVfPfND2y1OzG91id0lsXnYquORCH nP4ee0FIxHmiYtYqw+6xz1wmFjA0lO6do5BvLo8r60oroMknXvIKzbcC2VzL5GxZhvuNpZ cpMgxKsX/6yYu3wiADDxZPFVNShKo+i/2nSDqA5P1BkZyd7850Y/+10xAT9yDg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1779315858; a=rsa-sha256; cv=none; b=c2RyzeCt5MyMQAB1O1jjxhoFcX2foRYkG6oC43RP1mKsowk4x87gaAIPIJkkUlMHfNATeg 5Ta2JVMFEJhN2VMeEc11gngsi8fwqACl9RVHqAJ1Ge4J4C9Crw6DAlRMA9hpjepQUsMH9A gZ7BkHVEOfY7Vupq8+8r3sJaHhij7JJn82Fugktb6Ij2rUE/XCN6bZTd/eBxB4Lm++U8gu 5AF9YT0Z/5AJUMhuB0r9xH7G3SDtkFJtjaJWUUvfGPjwxjrZf0apv4w4jI5fMPWHPDKvaM ErwLJUeiXL3J7jH0J/+PBWPtZkaC/xUkFF24lEta1mq3Co8mknpPgVNrSiqOvA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779315858; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=Gp0CJwCAZmWwGY02xpa4GKUuVJ/1WAyq11ytkeNaCx8=; b=vvg/lKqqtMTZhTs2ctKiOtGB/JawSHlDGZrXzNRlkwnCeKSpk2orx2HAtj042O5P0Y7ohb IiR9lfW6vWQq6mcgimhCQuXNTuy0e8klnv/Gw/Ai4B3ZYg+GK4rtlGNYSV432N3q0e5b3u ER44cO3b4oWpuKE3z1e0fLJ7j5GIuHu9zgIstwPVIXrbj/2aEpy4AE8xP4QHjIP4isOzhb ZweIMgFzNAsk2iYXVOz/swNMRn8ymsqYabEkeZvFD7uo2OkdtFQKtbiZMotbdQqfCFKunY fnozWChirE/kRhToscwOpWIuwC9sSFeV4hwl+TwUvk85zHQXqod3tbVhC9mW8Q== Received: by freefall.freebsd.org (Postfix, from userid 945) id E4D519BF4; Wed, 20 May 2026 22:24:17 +0000 (UTC) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-26:24.cap_net Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20260520222417.E4D519BF4@freefall.freebsd.org> Date: Wed, 20 May 2026 22:24:17 +0000 (UTC) List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:24.cap_net Security Advisory The FreeBSD Project Topic: Incorrect libcap_net limitation list manipulation Category: core Module: libcap_net Announced: 2026-05-20 Credits: Joshua Rogers of AISLE Research Team Affects: All supported versions of FreeBSD. Corrected: 2026-05-19 23:03:59 UTC (stable/15, 15.0-STABLE) 2026-05-20 19:39:38 UTC (releng/15.0, 15.0-RELEASE-p9) 2026-05-19 23:04:13 UTC (stable/14, 14.4-STABLE) 2026-05-20 19:40:03 UTC (releng/14.4, 14.4-RELEASE-p5) 2026-05-20 19:40:41 UTC (releng/14.3, 14.3-RELEASE-p14) CVE Name: CVE-2026-45254 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background libcasper(3) allows Capsicum-sandboxed applications to define and use system interfaces which are otherwise not available in a capability sandbox, through implementing special services. One of these services, libcap_net, enables networking capabilities within the restricted environment. Casper services allow the application to define fine-grained limits on each operation handled by the service. Each service maintains a specific list of permitted operations. Certain operations can be further restricted by specifying an explicit list of allowed names. For example, libcap_net allows the application to limit the addresses to which the application may bind or connect. If it attempts to use libcap_net to bind or connect to addresses outside the allowed list, the operation will fail. In keeping with Capsicum's capability model, once a set of limits is applied, subsequent adjustments may only narrow the set of permitted operations to a subset of the current one. II. Problem Description In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected. III. Impact In certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process. IV. Workaround No workaround is available. Note that no FreeBSD base system software is affected by this issue. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system installed from base system packages: Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base # shutdown -r +10min "Rebooting for a security update" 2) To update your vulnerable system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-26:24/cap_net.patch # fetch https://security.FreeBSD.org/patches/SA-26:24/cap_net.patch.asc # gpg --verify cap_net.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart all daemons that use the library, or reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 7eb3fd691d64 stable/15-n283630 releng/15.0/ f69df16fcc20 releng/15.0-n281047 stable/14/ b79faca1c596 stable/14-n274156 releng/14.4/ f977328c7277 releng/14.4-n273710 releng/14.3/ b3baecf08405 releng/14.3-n271510 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmoOKIMbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvCBgQANie9vi7Gg5seuAZqAjF JozB+Gs6qaHzHu1CcsDSjbm3Sx5l7p5vbdTR/qsdj9WJbORSI7l5CgB175s8Dbcn PrBYNHCa/+lQEMjRkxGrQF9+qr0W48jrARBgauqqzrYTXHAtLGG1e4S6s83w0IJP wZ/3zoEOb7dzcfvxOXSSa+BGcIirmzctg886IH1+EvQKluARzAMxFhNTMwbMMRe7 k0duMSU7KIlh2C23aMLUPlj1Su52gbiSMz3fDgl4i1cbo3xnQPQNWZnnlu8u+ZCB 2pXQoNag7AHTzaOMvOtIyYKXfR9OLdPa4Ii6D38s6WTUb5q0GmS6G7ISYOAnTM+3 TEvH2uhOpq8bySWb6TEx1ppedyIwZ+awocQ9XUeDvarJGCCTlBQ3kV08TMKKZxPA /DOWHJ9KSgKku9sKaLpbTNacpDmkipIEgKZdicifA9KpvH7frBlvwVsTzERVm/qy SVySVCqSE5fpYo6FN3Mo0GfN3EnBU2aYpPRx3RHvzKHTbQSU7iaNOu+Iki6GJuiH HTQ6oaWHmNAkotNN5tAdmDXrm9wnMncCbMT1JHrtEDanJWgKWEovhK1mw6LhHlg1 K+bvyTB6LyZYnOZXhb9540tXfyrmjdTzM/jNMZL1Z5AYjy1FfDdTxH460gIsy6PU f4TRsebl2L+EThYrx6pjoj5D =K5/f -----END PGP SIGNATURE-----