Skip to content
CVE PROGRAM SOURCE RECORD3.3 Low

CVE-2024-25941

jail(2) information leak

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

The jail(2) system call has not limited a visiblity of allocated TTYs (the kern.ttys sysctl). This gives rise to an information leak about processes outside the current jail. Attacker can get information about TTYs allocated on the host or in other jails. Effectively, the information printed by "pstat -t" may be leaked.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 14.0-RELEASE to < p5affected
  • 13.2-RELEASE to < p10affected

References