Executive brief
mport is the package manager for MidnightBSD, responsible for downloading, installing, and managing software packages. Prior to version 2.7.8, a local attacker with write access to package cache directories could exploit race conditions to redirect package downloads or bypass integrity checks, potentially allowing installation of malicious software or unauthorized modification of the system.
Technical details
The vulnerability is a time-of-check/time-of-use (TOCTOU) race condition affecting privileged package fetch and cache-cleaning operations across multiple components (libmport/fetch.c, libmport/clean.c, libmport/util.c, and others). The vulnerable code performed path validation and file operations non-atomically, allowing a local attacker with write access to package cache or staging directories to race checks and replacement operations. Additionally, the affected lifecycle helper paths used shell-form invocation during privileged helper execution, increasing command-line interpretation risk. The issue is fixed in version 2.7.8 by validating filenames, using directory file descriptors for race-resistant operations, and replacing shell hooks with safer execution methods.
Affected products
- MidnightBSD mport prior to 2.7.8
Timeline
- 2026-04-23: patched: Security fix merged in commit 29154b0
- 2026-09-17: disclosed