setcred

KO | EN

gitlite — search

#react #typescript #go #deep-learning #linux #docker #nodejs #windows #cli #kubernetes #awesome-list #vue #pytorch #ios

(★ 22)

CVE-2026-45250: FreeBSD 14.4 setcred kernel buffer overflow (LPE)

setcred Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# FreeBSD setcred(2) — research artifacts

This subdirectory collects the write-up and working exploits for the
`setcred(2)` stack buffer overflow in FreeBSD 14.x kernel.

The vulnerability itself is fully documented in `setcred.txt`. The short
version: `kern_setcred_copyin_supp_groups()` uses `sizeof(*groups)` where
`groups` is `gid_t **`, producing an 8-byte stride instead of 4 for a
`copyin()` into a fixed-size kernel-stack array. The overflow is reachable
before any privilege check, by any unprivileged user.

This repository captures two working exploit paths:

* **no-SMAP / no-SMEP** — `exp2_lpe_no_smap.c`.  A single
    `setcred(2)` syscall flips the calling thread to uid=0 by
    redirecting the chain primitive at `amd64_syscall+0x155` to
    user-space shellcode through a fake `struct sysentvec`.

* **SMAP / SMEP enabled** — `exp_setcred_smap_zfs.c`.  Hijacks to
    `ZSTD_initCStream_advanced` in `zfs.ko` whose body writes
    `td_ucred = rcx+1`.  With `rcx = K1 = parent_pargs - 1` (a
    qword planted in a child's pargs slab), the calling thread's
    credential pointer lands inside the parent's pargs slab where
    we have planted a fake `struct ucred` with `cr_uid=0`.  Works
    on any FreeBSD 14.4 GENERIC system with `zfs.ko` loaded
    (typical server configuration) and requires no kernel
    info-leak primitive.

## Layout

```
setcred/
+- setcred.txt          Primary write-up: vulnerability, both LPE
|                       techniques, PoC pointers, FIX STATUS, timeline.
|                       Pure ASCII.
+- exploits/            Curated exploit drop.
    +- poc_dos.c                    Minimal DoS PoC -- any user
    |                               panics kernel.
    +- exp2_lpe_no_smap.c           Full LPE on no-SMAP/SMEP kernel.
    +- exp_setcred_smap_zfs.c       SMAP/SMEP-safe LPE via zfs.ko
    |                               ZSTD gadget.  No info-leak.
    +- wrapper.c                    Tiny setuid-root → /bin/sh
    |                               launcher installed at /tmp/rsh
    |                               by exp_setcred_smap_zfs.
    +- Makefile.setcred_smap_zfs    Guest-side build pipeline for
    |                               the SMAP/SMEP path
    |                               (all, install, clean).
    +- README_setcred_smap_zfs.md   End-user write-up for the
                                    SMAP/SMEP path.
```

## Status

* DoS (any user panics the kernel) and full LPE without SMAP/SMEP
    are reproducible by the corresponding programs in `exploits/`.

* Full LPE with SMAP/SMEP enabled is reproducible via
    `exp_setcred_smap_zfs.c` on any FreeBSD 14.4 GENERIC system with
    `zfs.ko` loaded.  See `setcred.txt` for the technique.

* 14.4-RELEASE / stable/14 remain vulnerable as of report date.
    The fix landed in main on 2025-11-27 (commit 000d5b5) as a side
    effect of an unrelated refactoring and was not backported.

setcred

setcred Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

setcred

setcred Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README