CVEvulnerability

CVE-2026-58089

7.8 HIGH Published 2026-08-26 Modified 2026-09-24 Official page ↗
Status
Analyzed
Published
2026-08-26
Last modified
2026-09-24
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-273

Description

When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.

Affected configurations

• freebsd freebsd 14.4 • freebsd freebsd 15.0 • freebsd freebsd 15.1

Related

Weakness · CWE (1)

  • CWE-273 Improper Check for Dropped Privileges weakness

References