Vulnerability · Published Aug 11, 2024 · Assigned by freebsd

CVE-2024-6760ktrace(2) fails to detach when executing a setuid binary

High 7.5

In plain English

A high-severity missing authorization in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 45.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users to trace and inspect the behavior of setuid programs. The bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database.

Affected products (as reported)

Vendor	Product	Versions
FreeBSD	FreeBSD	14.1-RELEASE – before p314.0-RELEASE – before p913.3-RELEASE – before p5

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References