-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

============================================================================= FreeBSD-SA-26:59.mac_do Security Advisory
The FreeBSD Project

Topic: Unauthorized credential switching

Category: core
Module: mac_do
Announced: 2026-08-25
Credits: Hazley Samsudin of GovTech CSG
Affects: FreeBSD 15.0 and later
Corrected: 2026-08-25 15:59:49 UTC (stable/15, 15.1-STABLE)
2026-08-25 16:01:24 UTC (releng/15.1, 15.1-RELEASE-p3)
2026-08-25 16:01:03 UTC (releng/15.0, 15.0-RELEASE-p13)
CVE Name: CVE-2026-58092

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>.

I. Background

mac_do(4) is a MAC policy module that allows unprivileged processes to
switch credentials using setcred(2), subject to administrator-defined
rules. Rules can restrict transitions based on the calling process'
user and group identities.

II. Problem Description

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element
of the array containing the list of supplementary group IDs, whereas now
the primary group ID is stored in a dedicated field. This change was
largely internal to the kernel and not user-visible.

One function, group_is_primary(), was not properly updated as a part of
this transition. This function is used by mac_do to determine the
primary group ID of the credential after applying a transition rule,
used when the rule target does not explicitly specify a group.

As a result, with certain mac_do rules, it is possible for a credential
switch to incorrectly set the primary group ID to the ID stored in the
first element of the original credential's supplementary group array.
If the list of supplementary groups is empty, this value will be 0, corresponding to the "wheel" group. For example, a rule such as "uid=1001>uid=1002" can be abused to set the primary group ID to 0 even
if the process did not originally belong to group 0.

III. Impact

Certain mac_do rules can be abused to set a process' group ID to 0.
Note however, that the rule must apply to the caller in order for the
bug to be triggered, e.g., given the ruleset "uid=1001>uid=1002", the
user must have user ID 1001 in order to trigger the bug.

Further, logged-in users will in general have a non-empty supplementary
group list, in which case the bug can at worst be used to set the
credential's first supplementary group ID as its primary group ID.
Processes must explicitly remove themselves from all supplementary
groups, using the privileged setgroups(2) system call, in order to
exploit the bug to set 0 as the primary group ID.

Since membership in group 0 is often used to enable controlled privilege escalation, the bug might be further exploitable to obtain root
privileges, depending on the system configuration. For instance, a
ruleset such as the following could be exploited by a process running
as user 1001 and with an empty supplementary group list: "uid=1001>uid=1002;gid=0>uid=0".

IV. Workaround

Systems that do not configure a mac_do ruleset are not affected.

Rulesets which explicitly specify a target group ID are not subject to
the bug.

V. Solution

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot the system.

Perform one of the following:

1) To update your vulnerable system installed from base system packages:

Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility:

# pkg upgrade -r FreeBSD-base
# shutdown -r +10min "Rebooting for a security update"

2) To update your vulnerable system installed from binary distribution sets:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"

3) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/SA-26:59/mac_do.patch
# fetch https://security.FreeBSD.org/patches/SA-26:59/mac_do.patch.asc
# gpg --verify mac_do.patch.asc

b) Apply the patch. Execute the following commands as root:

# cd /usr/src
# patch -E -p0 < /path/to/patch

c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

VI. Correction details

This issue is corrected as of the corresponding Git commit hash in the following stable and release branches:

Branch/path Hash Revision
- ------------------------------------------------------------------------- stable/15/ ae27dff4710b stable/15-n285145 releng/15.1/ 97b7439e3b06 releng/15.1-n283604 releng/15.0/ 00036dad647f releng/15.0-n281107
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://www.cve.org/CVERecord?id=CVE-2026-58092>

The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:59.mac_do.asc> -----BEGIN PGP SIGNATURE-----

iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3YIbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvS4IP/3NC1xmoJ/sd/RZLqW1f oLSf3q4coxvjbzjBsZc4um+nkiwEWdjX9ZXzZ+KR0XVV6VgXkhhEPqARmcc4OPTo nduczWRyqNzRTGzzWi0QpmY+K764ZA2rObChnc8Bs/s75dl9AXinjF9G0hMM29i7 dfcsh8vPLFPkdtXtiReGFrf7c6CryOqEZfAW71FQCv6q1/0YEiogWfeb+mvvfhOq qj2xxSAbNeIwXqOtTQ2IiZMEfFAR+0TZ506iWesxoEI9JoHBSoSkb0ZZLCUybr26 iCIhA0yA9sxnFVYvsbbLsatNTxyP9cR5gryJDYQCzwwm9TmdWp74PzGKvtdYN5TC rQi+6Ounfbt1ez6IYr6r54HCgAb7jNljiTEi0P8xJSvFuJcSvGJptzl6gZP2kIUS GH0PFIau2uXD0Lbh+aqkMAJKRnOzGx1ixCalhpFvg0b8CGEbCjiTooQaW641quWu ClquL69lzQljKikV8Qq0DobxBJRbGLREfIa8xCW4/Hf74ni7YrMQZBbzua3y4L2s lJaZumo2Capf7OT0A/ux5TAvmsY9X7pNg7K3GJ3apWgxRZu2bBeTm3j2+1skIhoN Fx7VgqyLboTxLkCUYohaLtcSav6ZKmhH8pUBkK/WutiZR8NLjfMoB8x+ZinL05Ym 0C2jYUClN06hrVUeSTwgh8Eu
=Uvrm
-----END PGP SIGNATURE-----


--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)