Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-6760

ktrace(2) fails to detach when executing a setuid binary

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users to trace and inspect the behavior of setuid programs. The bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 14.1-RELEASE to < p3affected
  • 14.0-RELEASE to < p9affected
  • 13.3-RELEASE to < p5affected

References