important · Privilege — FreeBSD
Three FreeBSD descriptor-handling flaws let a jailed process escape its filesystem root.
Affects
FreeBSD jails, operating-system-level isolation on FreeBSD hosts.
A jailed process must first receive a directory descriptor from another jail; the variants then clear, lose or bypass FD_RESOLVE_BENEATH through fdescfs, renameat handling or SCM_RIGHTS passing.