CVE-2024-43102 — umtx Kernel panic or Use-After-Free

Description (CNA)

Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early. A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.

Affected (CNA)

Vendor / product	Versions
FreeBSD / FreeBSD	affected 14.1-RELEASE before p4; affected 14.0-RELEASE before p10; affected 13.3-RELEASE before p6

CWE

CWE-416, CWE-911

References

https://security.freebsd.org/advisories/FreeBSD-SA-24:14.umtx.asc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://security.netapp.com/advisory/ntap-20240916-0001/