mirror of
https://github.com/openbsd/src.git
synced 2026-06-19 07:43:34 +02:00
deraadt
443dd5519a
in the process copy region the child gets this pointer. Before fork1() completes the process creation, it is possible for other processes to change the pgrp in an attacker controlled way, such that the pointer becomes stagnant. A very complicated AI-generated attack chaining many methods (which a experienced human could generate given sufficent time) suceeds at racing this stagnant pgrp object in the pool cache and can do things it should not. We need to start the children without a pgrp (ie. NULL), and update the pgrp pointer late. Found by Nicholas Carlini at Anthropic this is security errata 7.7/037_pgrp.patch.sig and 7.8/031_pgrp.patch.sig