FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- umtx Kernel panic or Use-After-Free

Affected packages
14.1	<=	FreeBSD	<	14.1_4
14.0	<=	FreeBSD	<	14.0_10
13.3	<=	FreeBSD	<	13.3_6

Details

VuXML ID	7e079ce2-6b51-11ef-9a62-002590c1f29c
Discovery	2024-09-04
Entry	2024-09-05

Problem Description:

Concurrent removals of such a mapping by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.

Impact:

A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.

References

CVE Name	CVE-2024-43102
FreeBSD Advisory	SA-24:14.umtx