An AI Audit of FreeBSD

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.calif.io/p/an-ai-audit-of-freebsd
• Blog Title: An AI Audit of FreeBSD
• Suggested Section: Binary Exploitation > Kernel Exploitation / FreeBSD Kernel Exploitation

🎯 Content Summary

Calif's “An AI Audit of FreeBSD” describes an AI-assisted FreeBSD kernel security audit that produced 15 reported kernel bugs: 3 remote code execution vulnerabilities, 5 local privilege escalation vulnerabilities, 1 bhyve guest-to-host escape, and multiple memory disclosure and denial-of-service issues. The work was coordinated with the FreeBSD team, with a stated focus on high/critical issues, short reports, PoCs, and suggested patches when useful.

<strong...

🔧 Technical Details

Kernel stack overflow from a sizeof confusion in copy-in credential code: if privileged kernel code copies user-controlled or semi-user-controlled data using a wrong sizeof target, a tiny source-level mistake can become a stack-frame overwrite. In the FreeBSD setcred case, kern_setcred_copyin_supp_groups mishandles the supplementary group copy size, corrupting user_setcred's stack frame. The general exploitation pattern is to identify the exact caller frame layout for the vulnerable kernel build, determine which locals/control data can be reached by the overflow, and shape the overflow into a credential or control-flow primitive. The post emphasizes that exploitability can be highly version-specific: the same source bug exists in FreeBSD 14.3, 14.4, and 15.0, but only 14.4 is exploitable with the released exploit.

Out-of-bounds syscall dispatch table indexing through redirected syscalls: sysc...

🤖 Agent Actions

Done.

Updated:

• src/binary-exploitation/freebsd-ptrace-rfi-vm_map-prot_exec-bypass-ps5.md

Added concise FreeBSD-kernel-relevant content covering:

• copyin/copyout sizeof(pointer) vs element-size stack corruption patterns
• redirected syscall number revalidation before sysent indexing
• stale selinfo / poll waiter lifetime bugs leading to TAILQ_REMOVE-based kernel pointer writes

Also added the Calif blog and writeup references to the file’s final ## References section.

Validation:

• basic markdown structure checks passed
• reviewed git diff
• mdbook build could not be run here because mdbook is not installed in the environment (/bin/bash: mdbook: command not found)

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.calif.io/p/an-ai-audit-of-freebsd

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation > Kernel Exploitation / FreeBSD Kernel Exploitation".

Repository Maintenance:

• MD Files Formatting: 974 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0