Is the FreeBSD Remote Code Execution Vulnerability fixed in 26.03?

uniqueusername

Hi,

My understanding is that Claude Mythos found the following RCE in FreeBSD:

https://www.freebsd.org/security/advisories/FreeBSD-SA-26:08.rpcsec_gss.asc

The release of pfsense 26.03 seems to be in time to pick up the fix in FreeBSD, but my searches and checks do not turn up the magic link to tell me definitely that it is fixed in the current stable branch.

Can someone confirm we have the fix and moving forward make it a bit more obvious in the release notes which version of FreeBSD we have. This table entry and link is undecipherable: 16.0-CURRENT@c215eef34550. If someone can decode it, that might help.

Anything to clearly communicate the state of security in the firewall would be appreciated. RCE's in the days of AI exploits is unnerving to say the least.

Thanks for all your efforts!

Regards,

Neil

johnpoz

@uniqueusername said in Is the FreeBSD Remote Code Execution Vulnerability fixed in 26.03?:

https://www.freebsd.org/security/advisories/FreeBSD-SA-26:08.rpcsec_gss.asc

Kernels that do not have kgssapi.ko loaded are not vulnerable.

If I look on my 26.03

[26.03-RELEASE][admin@sg4860.home.arpa]/root: kldstat
Id Refs Address                Size Name
 1   36 0xffffffff80200000  31ef360 kernel
 2    1 0xffffffff833f1000   629670 zfs.ko
 3    1 0xffffffff83a1b000    1e320 opensolaris.ko
 4    1 0xffffffff84220000     5b60 udf.ko
 5    1 0xffffffff84226000     23a0 cpuctl.ko
 6    1 0xffffffff84229000     4250 ichsmb.ko
 7    1 0xffffffff8422e000     2178 smbus.ko
 8    1 0xffffffff84231000     a290 aesni.ko
 9    1 0xffffffff8423c000     4b18 cryptodev.ko
11    1 0xffffffff84271000     20f0 coretemp.ko
12    1 0xffffffff84274000     4d10 ichwd.ko
13    1 0xffffffff84241000    2f5e0 if_wg.ko
[26.03-RELEASE][admin@sg4860.home.arpa]/root:

that doesn't seem to be loaded.

stephenw10

It's not a module we ship as available to load either.

patient0

@uniqueusername said in Is the FreeBSD Remote Code Execution Vulnerability fixed in 26.03?:

This table entry and link is undecipherable: 16.0-CURRENT@c215eef34550. If someone can decode it, that might help.

I'd say the versioning is reasonable. pfSense is running on FreeBSD 16-CURRENT, source code git commit c215eef34550, maybe with patches applied.

pfSense is on running on CURRENT for a while, 'What is the FreeBSD-CURRENT concept?'.

uniqueusername

Thank you all for the responses! I always like learning something.

For us slightly less technical folks that use pfsense, its a high bar to hurdle to determine that on our own.

Can one rely on the fact that you will always tell us when a vulnerability has been addressed and leave it at that?

Silence means nothing to see here?

We're weeks away from a vulnerability disclosure tidal wave...

Thanks again,

Neil

stephenw10

Generally. yes, we review FreeBSD CVEs and assess whether or not they apply to pfSense. A lot (most? ) do not apply since pfSense is a very cut down subset of the FreeBSD code.