{
  "guidislink": false,
  "id": "https://tailscale.com/security-bulletins/#ts-2023-003",
  "link": "https://tailscale.com/security-bulletins/#ts-2023-003",
  "links": [
    {
      "href": "https://tailscale.com/security-bulletins/#ts-2023-003",
      "rel": "alternate",
      "type": "text/html"
    }
  ],
  "published": "Wed, 22 Mar 2023 00:00:00 GMT",
  "summary": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eReference\u003c/em\u003e\u003c/strong\u003e: \u003ca href=\"https://www.cve.org/CVERecord?id=CVE-2023-28436\"\u003eCVE-2023-28436\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eSeverity\u003c/em\u003e\u003c/strong\u003e: Medium\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eCVSS vector string\u003c/em\u003e\u003c/strong\u003e: CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: A vulnerability identified in the implementation of Tailscale SSH in FreeBSD allowed commands to be run with a higher privilege group ID than that specified by Tailscale SSH access rules.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eAffected platforms\u003c/em\u003e\u003c/strong\u003e: FreeBSD\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003ePatched Tailscale client versions\u003c/em\u003e\u003c/strong\u003e: v1.38.2 or later\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eA difference in the behavior of the FreeBSD \u003ccode\u003esetgroups\u003c/code\u003e system call from POSIX meant that the Tailscale client running on a FreeBSD-based operating system did not appropriately restrict groups on the host when using Tailscale SSH. When accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process was used instead of that of the user specified in Tailscale SSH access rules.\u003c/p\u003e\n\u003ch4\u003eWho is affected?\u003c/h4\u003e\n\u003cp\u003e9 tailnets with 22 FreeBSD nodes running Tailscale SSH since Tailscale v1.34 (released on 2022-12-04) may have had Tailscale SSH sessions with a higher privilege group ID than that specified in Tailscale SSH access rules.\u003c/p\u003e\n\u003cp\u003eWe have notified affected organizations where we have \u003ca href=\"https://tailscale.com/kb/1224/contact-preferences/#setting-the-security-issues-email\"\u003esecurity contacts\u003c/a\u003e.\u003c/p\u003e\n\u003ch4\u003eWhat is the impact?\u003c/h4\u003e\n\u003cp\u003eTailscale SSH commands may have been run with a higher privilege group ID than that specified in Tailscale SSH access rules if they met all of the following criteria:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe destination node was a FreeBSD device with Tailscale SSH enabled;\u003c/li\u003e\n\u003cli\u003eTailscale SSH access rules permitted access for non-root users; and\u003c/li\u003e\n\u003cli\u003eA non-interactive SSH session was used.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eIf you are running Tailscale on FreeBSD, upgrade to v1.38.2 or later to remediate the issue. Admins of a tailnet can view \u003ca href=\"https://login.tailscale.com/admin/machines?q=version%3A%3C1.38.2+freebsd\"\u003eFreeBSD nodes with unpatched versions\u003c/a\u003e in the admin console.\u003c/p\u003e\n\u003cp\u003eTo update the local ports tree in advance of what\u0027s available upstream, you can:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003ccode\u003ecd /usr/ports/security/tailscale\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eedit the Makefile to set \u003ccode\u003ePORTVERSION\u003c/code\u003e to \u003ccode\u003e1.38.2\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003emake makesum\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003emake install\u003c/code\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eTailscale SSH on other platforms is not affected.\u003c/p\u003e\n\u003ch4\u003eCredits\u003c/h4\u003e\n\u003cp\u003eWe would like to thank \u003ca href=\"https://www.linkedin.com/in/rbelgrave/\"\u003eRyan Belgrave\u003c/a\u003e for reporting this issue.\u003c/p\u003e",
  "summary_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/html",
    "value": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eReference\u003c/em\u003e\u003c/strong\u003e: \u003ca href=\"https://www.cve.org/CVERecord?id=CVE-2023-28436\"\u003eCVE-2023-28436\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eSeverity\u003c/em\u003e\u003c/strong\u003e: Medium\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eCVSS vector string\u003c/em\u003e\u003c/strong\u003e: CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: A vulnerability identified in the implementation of Tailscale SSH in FreeBSD allowed commands to be run with a higher privilege group ID than that specified by Tailscale SSH access rules.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eAffected platforms\u003c/em\u003e\u003c/strong\u003e: FreeBSD\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003ePatched Tailscale client versions\u003c/em\u003e\u003c/strong\u003e: v1.38.2 or later\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eA difference in the behavior of the FreeBSD \u003ccode\u003esetgroups\u003c/code\u003e system call from POSIX meant that the Tailscale client running on a FreeBSD-based operating system did not appropriately restrict groups on the host when using Tailscale SSH. When accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process was used instead of that of the user specified in Tailscale SSH access rules.\u003c/p\u003e\n\u003ch4\u003eWho is affected?\u003c/h4\u003e\n\u003cp\u003e9 tailnets with 22 FreeBSD nodes running Tailscale SSH since Tailscale v1.34 (released on 2022-12-04) may have had Tailscale SSH sessions with a higher privilege group ID than that specified in Tailscale SSH access rules.\u003c/p\u003e\n\u003cp\u003eWe have notified affected organizations where we have \u003ca href=\"https://tailscale.com/kb/1224/contact-preferences/#setting-the-security-issues-email\"\u003esecurity contacts\u003c/a\u003e.\u003c/p\u003e\n\u003ch4\u003eWhat is the impact?\u003c/h4\u003e\n\u003cp\u003eTailscale SSH commands may have been run with a higher privilege group ID than that specified in Tailscale SSH access rules if they met all of the following criteria:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe destination node was a FreeBSD device with Tailscale SSH enabled;\u003c/li\u003e\n\u003cli\u003eTailscale SSH access rules permitted access for non-root users; and\u003c/li\u003e\n\u003cli\u003eA non-interactive SSH session was used.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eIf you are running Tailscale on FreeBSD, upgrade to v1.38.2 or later to remediate the issue. Admins of a tailnet can view \u003ca href=\"https://login.tailscale.com/admin/machines?q=version%3A%3C1.38.2+freebsd\"\u003eFreeBSD nodes with unpatched versions\u003c/a\u003e in the admin console.\u003c/p\u003e\n\u003cp\u003eTo update the local ports tree in advance of what\u0027s available upstream, you can:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003ccode\u003ecd /usr/ports/security/tailscale\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eedit the Makefile to set \u003ccode\u003ePORTVERSION\u003c/code\u003e to \u003ccode\u003e1.38.2\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003emake makesum\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003emake install\u003c/code\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eTailscale SSH on other platforms is not affected.\u003c/p\u003e\n\u003ch4\u003eCredits\u003c/h4\u003e\n\u003cp\u003eWe would like to thank \u003ca href=\"https://www.linkedin.com/in/rbelgrave/\"\u003eRyan Belgrave\u003c/a\u003e for reporting this issue.\u003c/p\u003e"
  },
  "title": "TS-2023-003",
  "title_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/plain",
    "value": "TS-2023-003"
  }
}