Description (CNA)
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| FreeBSD / FreeBSD | affected 15.1-RELEASE before p4 |
CWE
CWE-362, CWE-416
References
ADP enrichment
No English description supplied.
No references supplied.