CVE-2026-45257HIGH· 7.8MITRENVD대응게시일: 2026. 06. 26.수정일: 2026. 06. 27.CNA: secteam@freebsd.orgAnalyzed

The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음

CVSS

7.8high

이론적 심각도 점수

EPSS

0.2%상위 95.0%

30일 내 악용 확률 예측

KEV

미등재

실측 악용 기록 없음

권장 대응 기한차기 업그레이드 시CISA SSVC 기준

별도 긴급 패치 불필요 — 정기 시스템 업그레이드 주기에 맞춰 조치

완전 장악· KEV 미등재 · 자동화 어려움 · 완전 장악 · 내부 한정

CVSS 벡터 · 메트릭

악용 경로

공격 벡터로컬

공격 복잡도낮음

필요 권한낮음

사용자 상호작용불필요

범위불변

영향

기밀성 영향높음

무결성 영향높음

가용성 영향높음

버전별 점수

CVSS 3.17.8HIGH· 악용성 1.8· 영향도 5.9

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

약점 (CWE)

CWE-123

상세 설명

The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When the sender transmits such data over a loopback connection without enabling KTLS on the transmit side, the file-backed mbufs reach the receiver's decryption path unchanged. Decrypting a record in place then overwrites the backing file's page cache instead of a private copy of the data.

An unprivileged local user who can read a file can overwrite its contents with data of their choosing by sending the file over a loopback connection on which they have enabled KTLS receive. The write modifies the page cache directly, so it bypasses file flags such as schg and is written back to disk. By overwriting a setuid binary or other trusted file, a local user can escalate privileges, potentially gaining full control of the affected system.

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

영향받는 제품·버전

freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other
freebsd freebsd
other

영향받는 구성 (CPE) 33

freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p12:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p13:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p14:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*
freebsd freebsd 14.3cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*
freebsd freebsd 14.4cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*
freebsd freebsd 14.4cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*
freebsd freebsd 14.4cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*
freebsd freebsd 14.4cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*
freebsd freebsd 14.4cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*
freebsd freebsd 14.4cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:*
freebsd freebsd 14.4cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*
freebsd freebsd 15.0cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*
freebsd freebsd 15.0cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*
freebsd freebsd 15.0cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*
freebsd freebsd 15.0cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*
freebsd freebsd 15.0cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*
freebsd freebsd 15.0cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*
freebsd freebsd 15.0cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*
freebsd freebsd 15.0cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*
freebsd freebsd 15.0cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*
freebsd freebsd 15.0cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*
freebsd freebsd 15.1cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:*

참고 자료 4

https://security.freebsd.org/advisories/FreeBSD-SA-26:26.ktls.asc
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/10/20
Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/06/10/21
Mailing ListThird Party Advisory
https://www.heise.de/en/news/FreeBSD-Privilege-Escalation-Vulnerability-with-Tongue-in-Cheek-Codename-11329109.html
Third Party Advisory

링크 내용 불러오는 중…