CVE-2025-15547: FreeBSD Jail Privilege Escalation Flaw

CVE-2025-15547 Overview

CVE-2025-15547 is a privilege escalation vulnerability affecting FreeBSD jail environments configured to allow nullfs(4) mounts. By default, jailed processes cannot mount filesystems, including nullfs(4). However, when the allow.mount.nullfs option is enabled, a limitation in the kernel's path lookup logic allows a privileged user within the jail to escape the jail's chroot environment and gain access to the full filesystem of the host or parent jail.

This vulnerability represents a critical container escape scenario where the intended isolation guarantees of FreeBSD jails are compromised. A jailed root user with the ability to perform nullfs mounts can leverage the path lookup flaw to traverse outside the jail's filesystem root, effectively breaking the security boundary between the jail and host system.

Critical Impact

Jailed root users can escape the jail's filesystem root and access the host or parent jail's complete filesystem, completely undermining jail isolation.

Affected Products

• FreeBSD systems with jails configured with allow.mount.nullfs option enabled
• FreeBSD jails permitting nullfs(4) mounts from within the jail environment
• Containerized FreeBSD deployments using nullfs for filesystem sharing

Discovery Timeline

• 2026-03-09 - CVE CVE-2025-15547 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2025-15547

Vulnerability Analysis

This vulnerability is classified under CWE-269 (Improper Privilege Management) and represents a jail escape condition in FreeBSD. The core issue lies within the kernel's path lookup logic when processing nullfs(4) mount operations from within a jail environment.

FreeBSD jails are designed to provide process isolation by restricting the root directory visible to jailed processes. The nullfs filesystem type allows mounting one directory tree onto another location, creating a mirror or alias of the original directory structure. While the allow.mount.nullfs option subjects mount operations to privilege checks, the path resolution mechanism fails to properly enforce jail chroot boundaries.

When a privileged user within a jail mounts a nullfs filesystem, the kernel's path lookup logic can be manipulated to resolve paths outside the jail's chroot. This allows the attacker to effectively break out of the jail's filesystem namespace and access files on the host system or parent jail.

Root Cause

The root cause is improper privilege management in the kernel's path lookup implementation for nullfs(4) mounts. The vulnerability stems from a limitation where the path resolution logic does not adequately enforce the jail's filesystem root boundary during nullfs mount operations. This allows directory traversal that bypasses the chroot isolation intended to confine jailed processes.

Attack Vector

The attack requires local access with root privileges within a jail that has been configured with the allow.mount.nullfs option. The attacker exploits the path lookup limitation by performing strategic nullfs mounts that leverage the kernel's failure to properly validate paths against the jail's root directory constraint.

The exploitation flow involves:

1. Attaining root privileges within a target jail (legitimate administrator access or through another vulnerability)
2. Identifying that the jail permits nullfs mounts via allow.mount.nullfs
3. Crafting nullfs mount operations that exploit the path lookup flaw
4. Accessing files outside the jail's intended filesystem root boundary

For technical exploitation details, refer to the FreeBSD Security Advisory.

Detection Methods for CVE-2025-15547

Indicators of Compromise

• Unexpected nullfs mount operations within jail environments
• File access logs showing access to paths outside the jail's configured root directory
• Anomalous mount entries in /etc/fstab or active mount table within jails
• Evidence of data exfiltration or modification of host filesystem resources

Detection Strategies

• Monitor jail environments for nullfs mount syscalls and audit mount operations
• Implement file integrity monitoring on host filesystems to detect unauthorized access from jails
• Review jail configurations for unnecessary allow.mount.nullfs permissions
• Deploy host-based intrusion detection systems to alert on unexpected cross-boundary filesystem access

Monitoring Recommendations

• Enable FreeBSD audit subsystem to log all mount operations within jails
• Configure alerting for any nullfs mount attempts in production jail environments
• Regularly audit jail configurations to identify overly permissive mount capabilities
• Monitor host system files for unauthorized modifications originating from jail processes

How to Mitigate CVE-2025-15547

Immediate Actions Required

• Review all jail configurations and disable allow.mount.nullfs where not strictly required
• Apply the security patch referenced in FreeBSD-SA-26:02.jail once available
• Audit existing jails for any signs of exploitation or unauthorized filesystem access
• Implement the principle of least privilege for jail mount permissions

Patch Information

FreeBSD has issued security advisory FreeBSD-SA-26:02.jail addressing this vulnerability. System administrators should consult the FreeBSD Security Advisory for patch details and upgrade instructions. Apply the recommended patches or upgrade to a patched FreeBSD version as soon as possible.

Workarounds

• Disable allow.mount.nullfs in jail configurations where nullfs mounts are not essential
• Use alternative filesystem sharing mechanisms that do not require in-jail mount privileges
• Restrict jail root user capabilities using additional FreeBSD security features
• Consider migrating sensitive workloads to jails without mount permissions until patches are applied

# Configuration example - Disable nullfs mount permission in jail.conf
# Edit /etc/jail.conf and ensure allow.mount.nullfs is not enabled

myjail {
    path = "/jail/myjail";
    host.hostname = "myjail.example.com";
    # Remove or comment out the following line to disable nullfs mounts
    # allow.mount.nullfs = 1;
    allow.mount.nullfs = 0;
}