CVE-2024-43102

Critical

Description

Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early. A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.

SeverityCritical

CVSS10.0

Exploit probability—

Product

Freebsd

PublishedSep 5, 2024

First seenSep 5, 2024

Weakness typeCWE-416Use after free CWE-911CWE-911

How to fix

Update

freebsd freebsd13.3 or later

Vendor advisories

security.freebsd.org/advisories/FreeBSD-SA-24:14.umtx.asc

Affected products

Product	Affected versions	Fixed in
freebsd freebsd	13.0 ≤ v < 13.3, 13.3, 13.4, 14.0, 14.1	13.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.