ISOMAN

CVE

CVE-2026-49414

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.

Severity
HIGH
CVSS
7.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
FreeBSD15.0-RELEASE amd64 bootonlyunknownsource
FreeBSD15.0-RELEASE amd64 disc1unknownsource
FreeBSD15.0-RELEASE amd64 dvd1unknownsource
FreeBSD15.0-RELEASE amd64 memstickunknownsource
FreeBSD15.0-RELEASE amd64 mini-memstickunknownsource
FreeBSD15.0-RELEASE aarch64 pine64-ltsunknownsource
FreeBSD15.0-RELEASE aarch64 pine64unknownsource
FreeBSD15.0-RELEASE aarch64 pinebookunknownsource
FreeBSD15.0-RELEASE aarch64 rock64unknownsource
FreeBSD15.0-RELEASE aarch64 rockpro64unknownsource
FreeBSD15.0-RELEASE aarch64 rpiunknownsource
FreeBSD15.0-RELEASE aarch64 bootonlyunknownsource
FreeBSD15.0-RELEASE aarch64 disc1unknownsource
FreeBSD15.0-RELEASE aarch64 dvd1unknownsource
FreeBSD15.0-RELEASE aarch64 memstickunknownsource
FreeBSD15.0-RELEASE aarch64 mini-memstickunknownsource
FreeBSD15.0-RELEASE powerpc64 bootonlyunknownsource
FreeBSD15.0-RELEASE powerpc64 disc1unknownsource
FreeBSD15.0-RELEASE powerpc64le bootonlyunknownsource
FreeBSD15.0-RELEASE powerpc64le disc1unknownsource
FreeBSD15.0-RELEASE riscv64 genericsdunknownsource
FreeBSD15.0-RELEASE riscv64 bootonlyunknownsource
FreeBSD15.0-RELEASE riscv64 disc1unknownsource
FreeBSD15.0-RELEASE riscv64 memstickunknownsource
FreeBSD15.0-RELEASE riscv64 mini-memstickunknownsource
FreeBSD14.4-RELEASE amd64 bootonlyunknownsource
FreeBSD14.4-RELEASE amd64 disc1unknownsource
FreeBSD14.4-RELEASE amd64 dvd1unknownsource
FreeBSD14.4-RELEASE amd64 memstickunknownsource
FreeBSD14.4-RELEASE amd64 mini-memstickunknownsource
FreeBSD14.4-RELEASE aarch64 pine64-ltsunknownsource
FreeBSD14.4-RELEASE aarch64 pine64unknownsource
FreeBSD14.4-RELEASE aarch64 pinebookunknownsource
FreeBSD14.4-RELEASE aarch64 rock64unknownsource
FreeBSD14.4-RELEASE aarch64 rockpro64unknownsource
FreeBSD14.4-RELEASE aarch64 rpiunknownsource
FreeBSD14.4-RELEASE aarch64 bootonlyunknownsource
FreeBSD14.4-RELEASE aarch64 disc1unknownsource
FreeBSD14.4-RELEASE aarch64 dvd1unknownsource
FreeBSD14.4-RELEASE aarch64 memstickunknownsource
FreeBSD14.4-RELEASE aarch64 mini-memstickunknownsource
FreeBSD14.4-RELEASE i386 bootonlyunknownsource
FreeBSD14.4-RELEASE i386 disc1unknownsource
FreeBSD14.4-RELEASE i386 dvd1unknownsource
FreeBSD14.4-RELEASE i386 memstickunknownsource
FreeBSD14.4-RELEASE i386 mini-memstickunknownsource
FreeBSD14.4-RELEASE powerpc bootonlyunknownsource
FreeBSD14.4-RELEASE powerpc disc1unknownsource
FreeBSD14.4-RELEASE powerpc64 bootonlyunknownsource
FreeBSD14.4-RELEASE powerpc64 disc1unknownsource
FreeBSD14.4-RELEASE powerpc64le bootonlyunknownsource
FreeBSD14.4-RELEASE powerpc64le disc1unknownsource
FreeBSD14.4-RELEASE riscv64 genericsdunknownsource
FreeBSD14.4-RELEASE riscv64 bootonlyunknownsource
FreeBSD14.4-RELEASE riscv64 disc1unknownsource
FreeBSD14.4-RELEASE riscv64 memstickunknownsource
FreeBSD14.4-RELEASE riscv64 mini-memstickunknownsource
FreeBSD14.3-RELEASE amd64 bootonlyunknownsource
FreeBSD14.3-RELEASE amd64 disc1unknownsource
FreeBSD14.3-RELEASE amd64 dvd1unknownsource
FreeBSD14.3-RELEASE amd64 memstickunknownsource
FreeBSD14.3-RELEASE amd64 mini-memstickunknownsource
FreeBSD14.3-RELEASE aarch64 pine64-ltsunknownsource
FreeBSD14.3-RELEASE aarch64 pine64unknownsource
FreeBSD14.3-RELEASE aarch64 pinebookunknownsource
FreeBSD14.3-RELEASE aarch64 rock64unknownsource
FreeBSD14.3-RELEASE aarch64 rockpro64unknownsource
FreeBSD14.3-RELEASE aarch64 rpiunknownsource
FreeBSD14.3-RELEASE aarch64 bootonlyunknownsource
FreeBSD14.3-RELEASE aarch64 disc1unknownsource
FreeBSD14.3-RELEASE aarch64 dvd1unknownsource
FreeBSD14.3-RELEASE aarch64 memstickunknownsource
FreeBSD14.3-RELEASE aarch64 mini-memstickunknownsource
FreeBSD14.3-RELEASE i386 bootonlyunknownsource
FreeBSD14.3-RELEASE i386 disc1unknownsource
FreeBSD14.3-RELEASE i386 dvd1unknownsource
FreeBSD14.3-RELEASE i386 memstickunknownsource
FreeBSD14.3-RELEASE i386 mini-memstickunknownsource
FreeBSD14.3-RELEASE powerpc bootonlyunknownsource
FreeBSD14.3-RELEASE powerpc disc1unknownsource
FreeBSD14.3-RELEASE powerpc64 bootonlyunknownsource
FreeBSD14.3-RELEASE powerpc64 disc1unknownsource
FreeBSD14.3-RELEASE powerpc64le bootonlyunknownsource
FreeBSD14.3-RELEASE powerpc64le disc1unknownsource
FreeBSD14.3-RELEASE riscv64 genericsdunknownsource
FreeBSD14.3-RELEASE riscv64 bootonlyunknownsource
FreeBSD14.3-RELEASE riscv64 disc1unknownsource
FreeBSD14.3-RELEASE riscv64 memstickunknownsource
FreeBSD14.3-RELEASE riscv64 mini-memstickunknownsource

References

  1. https://security.freebsd.org/advisories/FreeBSD-SA-26:32.elf.asc