Several vulnerabilities in FreeBSD have been fixed that allowed a local user to escalate their privileges, execute code in the kernel context, or escape from an isolated environment:
- CVE-2024-43102 — a race condition in the implementation of the _umtx_op system call can be exploited to access a previously freed memory area (Use-After-Free) through simultaneous submissions of multiple UMTX_SHM_DESTROY subrequests. The vulnerability potentially allows bypassing the restrictions of the Capsicum isolation mechanism or achieving kernel-level code execution. The vulnerability has been assigned the highest severity level (10 out of 10). The issue has been resolved in updates 14.1-RELEASE-p4, 14.0-RELEASE-p10, and 13.3-RELEASE-p6.
- CVE-2024-45287, CVE-2024-45288 — vulnerabilities in the libnv library, used in both the kernel and user space for processing key/value formatted lists. The first issue is related to integer overflow, leading to allocating a buffer smaller than the block of data being written to the buffer. The second issue is caused by the lack of a null terminator in the last element of the array, resulting in the possibility of writing beyond the allocated buffer. The vulnerability could potentially be exploited to escalate privileges by overwriting memory areas in system processes or the kernel.
- CVE-2024-32668, CVE-2024-41928, CVE-2024-8178, CVE-2024-42416, CVE-2024-43110, CVE-2024-45063 — vulnerabilities in the bhyve hypervisor that could lead to code execution in a process running on the host system (typically with root privileges) during interactions inside the guest system with virtual USB controller drivers (XHCI), TPM, or ctl (SCSI emulation via CAM Target Layer).
- CVE-2024-6119 — a vulnerability in OpenSSL that causes applications to crash when verifying specially formatted X.509 certificate names provided in the otherName field.
Source: opennet.ru
