CVE-2020-25581
📋 TL;DR
A race condition in FreeBSD's jail_remove(2) system call may fail to kill some processes when removing a jail, potentially allowing processes to escape jail confinement. This affects FreeBSD systems using jails for process isolation, particularly those running vulnerable versions of FreeBSD 11.4 and 12.2.
💻 Affected Systems
- FreeBSD
📦 What is this software?
Freebsd by Freebsd
Freebsd by Freebsd
Freebsd by Freebsd
Freebsd by Freebsd
Freebsd by Freebsd
Freebsd by Freebsd
Freebsd by Freebsd
Freebsd by Freebsd
Freebsd by Freebsd
Freebsd by Freebsd
Freebsd by Freebsd
Freebsd by Freebsd
⚠️ Risk & Real-World Impact
Worst Case
Processes escape jail confinement, potentially gaining unauthorized access to the host system or other jails, leading to privilege escalation or lateral movement.
Likely Case
Some processes remain running after jail removal, causing resource leaks, inconsistent system state, or unexpected behavior in multi-jail environments.
If Mitigated
With proper monitoring and process management, escaped processes can be detected and terminated manually, limiting impact to resource consumption.
🎯 Exploit Status
Exploitation requires race condition timing and jail removal operations; no public exploits known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FreeBSD 12.2-STABLE r369312+, 11.4-STABLE r369313+, 12.2-RELEASE p4+, 11.4-RELEASE p8+
Vendor Advisory: https://security.FreeBSD.org/advisories/FreeBSD-SA-21:04.jail_remove.asc
Restart Required: Yes
Instructions:
1. Update FreeBSD using 'freebsd-update fetch' and 'freebsd-update install'. 2. Rebuild kernel if using custom kernel. 3. Reboot system to apply kernel changes.
🔧 Temporary Workarounds
Avoid jail removal during active operations
allMinimize use of jail_remove when jails contain active processes; stop all processes before removing jail.
# Before removing jail, stop all processes: jail -r jailname
# Or kill processes manually: pkill -j jailname
🧯 If You Can't Patch
- Monitor for orphaned processes after jail removal using 'ps -j' and manually terminate any escaped processes.
- Implement strict process monitoring and alerting for unexpected processes running outside jails.
🔍 How to Verify
Check if Vulnerable:
Run 'uname -a' to check FreeBSD version; if version matches affected range and jails are used, system is vulnerable.Check Version:
uname -aVerify Fix Applied:
After patching, verify version is patched with 'uname -a' and test jail removal with active processes to ensure all are terminated.📡 Detection & Monitoring
Log Indicators:
- Processes continuing to run after jail removal in system logs
- Unexpected process ancestry showing jail escape
Network Indicators:
- Network connections from processes that should be jailed appearing from host IP
SIEM Query:
process.parent.name:jail AND process.name NOT IN (expected_jail_processes)