CVE-2024-43102
Full vulnerability record from the local CVENow database.
Description
Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early. A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.
Severity
CRITICAL
CVSS score
10.0
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2024-09-05 05:15:13.677000
Last modified
2026-11-04 00:17:21.007000
View original CVE JSON
{
"id": "CVE-2024-43102",
"sourceIdentifier": "[email protected]",
"published": "2024-09-05T05:15:13.677",
"lastModified": "2026-11-04T00:17:21.007",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.\n\nA malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape."
},
{
"lang": "es",
"value": "Las eliminaciones simultáneas de ciertas asignaciones de memoria compartida anónimas mediante la subsolicitud UMTX_SHM_DESTROY de UMTX_OP_SHM pueden provocar que se reduzca el recuento de referencias del objeto que representa la asignación demasiadas veces, lo que hace que se libere demasiado pronto. Un código malicioso que ejecute la subsolicitud UMTX_SHM_DESTROY en paralelo puede provocar un pánico en el núcleo o permitir más ataques de use-after-free, que podrían incluir la ejecución de código o el escape de la zona protegida de Capsicum."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "FreeBSD",
"product": "FreeBSD",
"defaultStatus": "unknown",
"modules": [
"umtx"
],
"versions": [
{
"version": "14.1-RELEASE",
"lessThan": "p4",
"versionType": "release",
"status": "affected"
},
{
"version": "14.0-RELEASE",
"lessThan": "p10",
"versionType": "release",
"status": "affected"
},
{
"version": "13.3-RELEASE",
"lessThan": "p6",
"versionType": "release",
"status": "affected"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"vendor": "freebsd",
"product": "freebsd",
"defaultStatus": "unknown",
"cpes": [
"cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "14.1",
"lessThan": "14.1_p4",
"versionType": "custom",
"status": "affected"
},
{
"version": "14.0",
"lessThan": "14.0_p10",
"versionType": "custom",
"status": "affected"
},
{
"version": "13.3",
"lessThan": "13.3_p6",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-09-13T03:55:22.799641Z",
"id": "CVE-2024-43102",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-416"
},
{
"lang": "en",
"value": "CWE-911"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
"versionStartIncluding": "13.0",
"versionEndExcluding": "13.3",
"matchCriteriaId": "E82CE719-C11D-4C34-BDF9-5AA704884289"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:*",
"matchCriteriaId": "17DAE911-21E1-4182-85A0-B9F0059DDA7F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*",
"matchCriteriaId": "ABEA48EC-24EA-4106-9465-CE66B938635F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*",
"matchCriteriaId": "8DFB5BD0-E777-4CAA-B2E0-3F3357D06D01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*",
"matchCriteriaId": "BC8C769C-A23E-4F61-AC42-4DA64421B096"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p4:*:*:*:*:*:*",
"matchCriteriaId": "45B0589E-2E7D-4516-A8A0-88F30038EAB0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p5:*:*:*:*:*:*",
"matchCriteriaId": "C5CD8EF6-B119-488F-A278-8E9740E3E482"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:13.4:beta3:*:*:*:*:*:*",
"matchCriteriaId": "2F52349C-6051-4CB9-8659-763A22C31640"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*",
"matchCriteriaId": "FA25530A-133C-4D7C-8993-D5C42D79A0B5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "DB7B021E-F4AD-44AC-96AB-8ACAF8AB1B88"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*",
"matchCriteriaId": "69A72B5A-2189-4700-8E8B-1E5E7CA86C40"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*",
"matchCriteriaId": "5771F187-281B-4680-B562-EFC7441A8F88"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*",
"matchCriteriaId": "0A4437F5-9DDA-4769-974E-23BFA085E0DB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*",
"matchCriteriaId": "A9C3A3D4-C9F4-41EB-B532-821AF83470B1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*",
"matchCriteriaId": "878A1F0A-087F-47D7-9CA5-A54BB8D6676A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*",
"matchCriteriaId": "CE73CDC3-B5A7-4921-89C6-8F9DC426CB3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*",
"matchCriteriaId": "50A5E650-31FB-45BE-8827-641B58A83E45"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p8:*:*:*:*:*:*",
"matchCriteriaId": "D59CFDD3-AEC3-43F1-A620-0B1F0BAD9048"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p9:*:*:*:*:*:*",
"matchCriteriaId": "44B8A489-6314-460D-90DA-AFB54298C8E6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "038E5B85-7F60-4D71-8D3F-EDBF6E036CE0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*",
"matchCriteriaId": "BF309824-D379-4749-A1FA-BCB2987DD671"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.1:-:*:*:*:*:*:*",
"matchCriteriaId": "79D770C6-7A57-4A49-8164-C55391F62301"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*",
"matchCriteriaId": "AA813990-8C8F-4EE8-9F2B-9F73C510A7B2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p2:*:*:*:*:*:*",
"matchCriteriaId": "D4DFA201-27D5-4C01-B90F-E24778943C3B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p3:*:*:*:*:*:*",
"matchCriteriaId": "01DD321B-E5E2-49F7-86A1-D40B13E257C7"
}
]
}
]
}
],
"references": [
{
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:14.umtx.asc",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://security.netapp.com/advisory/ntap-20240916-0001/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}