FreeBSD reports critical vulnerability in the kernel
Take action: If you are running FreeBSD, time to patch ASAP. It's a really rare event to see such high severity issue in BSD systems, but it happened. And the users must put in the work to protect their computers.
Learn More
FreeBSD has issued a security advisory regarding a critical vulnerability in the umtx subsystem, which could lead to a kernel panic or a Use-After-Free condition.
The vulnerability, identified as CVE-2024-43102 (CVSS score 10), affects all supported versions of FreeBSD and was reported by Synacktiv, with support from The FreeBSD Foundation and The Alpha-Omega Project.
Vulnerability Description
The _umtx_op(2) system call in FreeBSD supports synchronization primitives between threads, utilized by the POSIX-compliant 1:1 Threading Library (libthr). The vulnerability arises within the UMTX_OP_SHM operation, which provides support for shared memory associated with a specific physical address.
Concurrent removals of a memory mapping using the UMTX_SHM_DESTROY sub-request can lead to an improper decrement of the reference count of the object representing the mapping. This may cause the object to be freed prematurely.
A malicious attacker executing the UMTX_SHM_DESTROY sub-request concurrently can cause a kernel panic, leading to a denial of service or perform a Use-After-Free attack, potentially resulting in code execution or escaping from a sandbox, increasing the severity of the attack.
Affected Versions are all supported versions of FreeBSD. There is no workaround available for this vulnerability.
Users are urged to upgrade the affected FreeBSD system to a stable or release/security branch dated after the correction date.
The issue has been resolved in the following branches with corresponding Git commit hashes:
| Branch/Path | Hash | Revision |
|---|---|---|
| stable/14/ | 4938f554469b | stable/14-n268665 |
| releng/14.1/ | f4a2dbb81603 | releng/14.1-n267707 |
| releng/14.0/ | 37823ca38148 | releng/14.0-n265444 |
| stable/13/ | a73a70472c47 | stable/13-n258319 |
| releng/13.4/ | 7739dab97433 | releng/13.4-n258248 |
| releng/13.3/ | 8fd0fa88b5a6 | releng/13.3-n257458 |
