CVE-2024-6760

HIGH

FreeBSD < 13.0 - Unauthenticated Missing Authorization via Kernel Tracing

Title source: llm
STIX 2.1

Description

A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users to trace and inspect the behavior of setuid programs. The bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database.

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0025
EPSS Percentile 48.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (4)
freebsd/freebsd 13.3 p1 (4 CPE variants)
freebsd/freebsd 14.0 beta5 (11 CPE variants)
freebsd/freebsd 14.1 p1 (2 CPE variants)
freebsd/freebsd < 13.0
Published Aug 12, 2024
Tracked Since Feb 18, 2026