CVE-2024-25941: jail(2) information leak
The jail(2) system call has not limited a visiblity of allocated TTYs (the kern.ttys sysctl). This gives rise to an information leak about processes outside the current jail.
Attacker can get information about TTYs allocated on the host or in other jails. Effectively, the information printed by "pstat -t" may be leaked.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25941?
CVE-2024-25941 has a moderate severity level due to the potential information leak about TTYs allocated on the host or in other jails.
How do I fix CVE-2024-25941?
To resolve CVE-2024-25941, you should upgrade to the latest patched version of FreeBSD as recommended in the security advisory.
What systems are affected by CVE-2024-25941?
CVE-2024-25941 affects FreeBSD versions 13.2 and 14.0 up to specific patch levels.
What is the impact of exploiting CVE-2024-25941?
Exploiting CVE-2024-25941 can result in unauthorized access to sensitive information about processes in other jails.
Is CVE-2024-25941 a remote attack vector?
CVE-2024-25941 allows information leakage potentially via local system access rather than a direct remote attack.