CVE-2024-43102
CRITICALFreeBSD 13.0-13.2 - Use-After-Free via UMTX_SHM_DESTROY Reference Count Mismanagement
Title source: llmDescription
Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early. A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.
References (2)
Core 2
Core References
Vendor Advisory
https://security.netapp.com/advisory/ntap-20240916-0001/
Vendor Advisory vendor-advisory
https://security.freebsd.org/advisories/FreeBSD-SA-24:14.umtx.asc
Scores
CVSS v3
10.0
EPSS
0.0114
EPSS Percentile
78.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-911
CWE-416
Status
published
Products (5)
freebsd/freebsd
13.3 (6 CPE variants)
freebsd/freebsd
13.4 beta3
freebsd/freebsd
14.0 (13 CPE variants)
freebsd/freebsd
14.1 (4 CPE variants)
freebsd/freebsd
13.0 - 13.3
Published
Sep 05, 2024
Tracked Since
Feb 18, 2026