The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer.
An unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Freebsd |
|
Configuration 1 [-]
|
No data.
References
History
Mon, 31 Aug 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:* |
Wed, 19 Aug 2026 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 19 Aug 2026 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Freebsd
Freebsd freebsd |
|
| Vendors & Products |
Freebsd
Freebsd freebsd |
Wed, 19 Aug 2026 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer. An unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation. | |
| Title | Heap out-of-bounds access in semctl(2) | |
| Weaknesses | CWE-125 CWE-191 CWE-787 |
|
| References |
|
MITRE
Status: PUBLISHED
Assigner: freebsd
Published: 2026-08-19T07:47:50.665Z
Updated: 2026-08-20T03:55:43.754Z
Reserved: 2026-06-29T01:40:17.498Z
Link: CVE-2026-58087
Vulnrichment
Updated: 2026-08-19T11:47:55.324Z
NVD
Status : Analyzed
Published: 2026-08-19T08:17:12.877
Modified: 2026-08-31T15:07:33.623
Link: CVE-2026-58087
Redhat
No data.