FreeBSD 15 1 Image © FreeBSDFreeBSD 15 1 (Image © FreeBSD)

Major Improvements in Security and Stability

FreeBSD 14.5 addresses a significant number of security vulnerabilities. The update resolves a wide range of issues, including remote code execution (RCE), denial-of-service (DoS) attacks, kernel stack overflows, and “use-after-free” bugs. The project specifically noted that some of these vulnerabilities were identified through the use of AI and analyses with large language models (LLMs).

In addition to security patches, this release includes various errata fixes. These range from correcting errors in memory zeroing within the page-fault handler to updating the time zone database and resolving TLB invalidation issues on certain AMD systems.

Hardware Driver and Device Updates

This release introduces several changes to hardware support to improve system compatibility and energy efficiency:

  • Apple Hardware: The ACPI driver now provides improved power management for Mac systems with two GPUs. By enabling “Darwin OSI” by default, the system can use the integrated GPU to extend battery life. However, support for 32-bit Intel-based Macs has been removed from the ASMC driver.
  • Storage controllers: The AHCI driver has been extended to support additional SATA controllers, specifically the Marvell 88SE9128 variant.
  • Peripherals: New keyboard layouts have been added, including the Lenovo layout and the US International layout with accent keys.
  • Network and Storage: The msdosfs file system now supports Unicode surrogate pairs, enabling the use of emojis and other extended characters on FAT32 volumes.

Software Stack and Userland Updates

FreeBSD 14.5 updates several core third-party libraries and utilities to ensure modern compatibility and security:

  • Core Components: The system now includes LLVM 21.1.8, OpenSSL 3.0.21, ncurses 6.6, and XZ 5.8.3.
  • **Tool Changes: The default linker for clang is now ld.lld. For the sh shell, the default history size has been increased from 100 to 128 to comply with the POSIX.1-2024 standard.
  • Network configuration: The rc.firewall script now allows administrators to load IP addresses or subnets from external files for trusted lists and permitted services.
  • System Utilities: The pwd command now uses the -L flag by default to conform to POSIX semantics, and the daemon utility introduces the -m option to specify output file modes.

Kernel and Bootloader Improvements

Significant architectural changes have been made to the kernel and the boot process:

  • Kernel Security: A new security check has been implemented to block unauthorized access to the kernel environment (kenv), thereby protecting sensitive system data.
  • Linux Compatibility: To improve source code compatibility with Linux, the kernel now includes inotify system calls, allowing applications to monitor file system events without having to open every single file.
  • Bootloader fixes: The loader.efi for amd64 has been patched to prevent boot errors when loading the microcode. In addition, NVIDIA kernel modules are now blacklisted by the loader to prevent system crashes during the early boot phase.
  • ZFS Integration: The ZFS runtime script is now scheduled to run before the tmp script. This ensures that ZFS volumes are properly mounted before the system checks for writability.

FreeBSD 14 upgrade to FreeBSD 14.5 How-To

Users upgrading to FreeBSD 14.5-RELEASE have two main options for the upgrade:

  • 1. Binary Upgrades: This is done using the freebsd-update utility, which updates the unmodified userland and GENERIC kernel. This method requires an active Internet connection.
  • 2. Upgrades from source code: Users who compile their system from source code can follow the instructions in the /usr/src/UPDATING directory.

The project recommends that all users perform a full backup of their data and configuration files before beginning the upgrade process.