Howdy!
The recently published CVE-2026-45257 - also called "bumsrakete" - affects FreeBSD 15.0, 14.x and 13.x.
Are there any considerations to patch OPNSense?
Cheers
https://www.freebsd.org/security/advisories/FreeBSD-SA-26:26.ktls.asc
https://bumsrake.de/
26.1.10 is being released later this afternoon.
Cheers,
Franco
Quote from: franco on June 15, 2026, 12:31:35 PM26.1.10 is being released later this afternoon.
Cheers,
Franco
Thank you Franco.
For those impatient and paranoid you can patch manually. Enable SSH on your OPNSense box, connect, and go to shell by pressing 8 and type this.
pkg install nano && nano /etc/sysctl.confAnd add this at the end of the file
kern.ipc.mb_use_ext_pgs=0Press Ctrl+X and chose Y to save your changes. And then uninstall nano if you wish.
pkg remove nanoYou can reboot to make this change take effect, or if you dont want to reboot, just type:
sysctl -w kern.ipc.mb_use_ext_pgs=0All done.
Dont forget to disable SSH if you dont need it.
Quote from: franco on June 15, 2026, 12:31:35 PM26.1.10 is being released later this afternoon.
Cheers,
Franco
Thank you for the info :-)
You can just as well use the GUI to set this tunable, no need for SSH.
System: Settings: Tunables
Quote from: Monviech (Cedrik) on June 15, 2026, 02:38:06 PMYou can just as well use the GUI to set this tunable, no need for SSH.
System: Settings: Tunables
I didnt know that. Thank you Cedrik.
Also you do not need to install nano to edit a file. Both vi and ee (the "easy editor") are available out of the box.
Quote from: Patrick M. Hausen on June 15, 2026, 03:00:33 PMAlso you do not need to install nano to edit a file. Both vi and ee (the "easy editor") are available out of the box.
Whos going to explain to absolute beginners that quitting and saving your changes requires pressing Esc key and then : and typing wq. Im trying to make these instructions as simple as possible for everyone. But the easiest way is what Cedric recommended.
I also install nano, much better experience :) Editor wars 2.0
At my second job I had to set "vim" as an alias for "nano" in order to force myself to use vim. True story.
Cheers,
Franco
PS: 26.1.10 is live
Quote from: Nullman on June 15, 2026, 03:06:47 PMWhos going to explain to absolute beginners that quitting and saving your changes requires pressing Esc key and then : and typing wq. Im trying to make these instructions as simple as possible for everyone. But the easiest way is what Cedric recommended.
As I was saying
ee is available as a reasonably easy alternative to vi. Introduced in August 1995, so available since FreeBSD 2.1 release.
Help I started ee and I cannot close it anymore, I want vim back.
Quote from: sopex on June 15, 2026, 03:07:24 PMI also install nano, much better experience :) Editor wars 2.0
I am pretty sure I used this : https://docs.freebsd.org/en/books/handbook/basics/#editors
A long time ago in FreeBSD 4/5/6 to edit all files and it was super easy to use just like Patrick said :
Quote from: Patrick M. Hausen on June 15, 2026, 03:00:33 PMAlso you do not need to install nano to edit a file.
Both vi and ee (the "easy editor") are available out of the box.
I think most of the time I just typed "edit file.conf" and that was it! :)
May we expect a fix for the business edition as well?
The most recent release from today is based on 26.1.9 (https://forum.opnsense.org/index.php?topic=52149.0) and there is no fix regarding this CVE mentioned on the page. So I guess, it might be still vulnerable.
Or should we go the manual path by setting the tunable?
Quote from: viragomann on June 16, 2026, 03:51:03 PMMay we expect a fix for the business edition as well?
The most recent release from today is based on 26.1.9 (https://forum.opnsense.org/index.php?topic=52149.0) and there is no fix regarding this CVE mentioned on the page. So I guess, it might be still vulnerable.
Or should we go the manual path by setting the tunable?
It's fixed. Maybe there is a need for better visibility but business edition always gets security fixes.
This is the relevant mention:
o src: arbitrary file overwrite via the KTLS receive path[15]
> Maybe there is a need for better visibility
No, these are not our CVEs. Trying to keep up with downstream security issues is futile.
The changelog already points to https://www.freebsd.org/security/advisories/FreeBSD-SA-26:26.ktls.asc were you can find up-to-date information like CVEs.
Cheers,
Franco
Quote from: franco on June 16, 2026, 05:18:39 PMNo, these are not our CVEs.
I meant something along the lines of
"This business release is based on the OPNsense 26.1.9 community version with additional
security and reliability improvements." because this person probably got a bit overwhelmed with all the improvements on the new version.
We are in a CVE apocalypse ofcourse no need to micromanage each security fix :)
Ahh. Thank you!
I searched the release notes for "kernel", but didn't find anything regarding this.
Quote from: sopex on June 15, 2026, 03:07:24 PMI also install nano, much better experience :) Editor wars 2.0
:-)
I first used Unix in the 1980s and only occasionally since then, enough to be familiar but never regular. At that time
vi was clearly better to use than
ed so I did, and have ever since. Also,
ZZ is quicker than
:wq
Quote from: franco on June 15, 2026, 12:31:35 PM26.1.10 is being released later this afternoon.
Hi Franco,
CVE-2026-45257 is not mentioned anywhere in the release notes for 26.1.10 (https://forum.opnsense.org/index.php?topic=52140.0), nor in the numbered footnotes 1 through 24 inclusive.
Can you please confirm that the patch made it into 26.1.10? If so, why is it not mentioned?
Thanks in advance!
----
EDIT to add: It seems to be referred to using its FreeBSD advisory in footnote 8, but not the CVE. IMHO the CVE should ALWAYS be included in the patch notes in addition to vendor-specific references!
We may list CVEs for other vendors, but only if no better reference exists. The FreeBSD advisory is clearly better than the CVE information. It's not even public yet:
https://www.cve.org/cverecord?id=CVE-2026-45257
Cheers,
Franco
Quote from: franco on June 18, 2026, 09:46:28 AMWe may list CVEs for other vendors, but only if no better reference exists. The FreeBSD advisory is clearly better than the CVE information. It's not even public yet:
All I'm asking is for you to even just mention the CVE number in the release notes; it makes it much easier to verify with certainty that a specific issue is patched in a release. Like so:
Quotesrc: arbitrary file overwrite via the KTLS receive path (CVE-2026-45257, FreeBSD-SA-26:26.ktls)[8]
I know what you're asking, but I already explained why I said "no", too.
Everyone can ask here or elsewhere; click and read the changelog references provided or gather more information on system impact if it's necessary for your local installation.
Cheers,
Franco