CVE-2024-6760: ktrace(2) fails to detach when executing a setuid binary
A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users to trace and inspect the behavior of setuid programs.
The bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6760?
CVE-2024-6760 is rated as a moderate severity vulnerability due to the potential exposure of sensitive information by unprivileged users.
How do I fix CVE-2024-6760?
To fix CVE-2024-6760, update to an unaffected version of FreeBSD, specifically any version beyond 13.3 or 14.0-p8.
Who is affected by CVE-2024-6760?
CVE-2024-6760 affects FreeBSD versions up to 13.3 and 14.0 up to 14.0-p8.
What is the impact of CVE-2024-6760?
The impact of CVE-2024-6760 allows unprivileged users to trace and inspect the behavior of setuid programs, potentially exposing sensitive data.
Can CVE-2024-6760 be exploited remotely?
CVE-2024-6760 requires local access, thus it cannot be directly exploited remotely without a prior compromise.