CVE-2024-43102

Estado: ModificadaCrítica (10)—
Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.
A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.
CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 10
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.68%
Percentil entre todas las CVEs puntuadas: 51
Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)

Freebsd — Freebsd
CWE

CWE-416, CWE-911
CWE-416
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-43102",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-43102",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-12T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secteam@freebsd.org",
      "affectedData": [
        {
          "vendor": "FreeBSD",
          "modules": [
            "umtx"
          ],
          "product": "FreeBSD",
          "versions": [
            {
              "status": "affected",
              "version": "14.1-RELEASE",
              "lessThan": "p4",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "14.0-RELEASE",
              "lessThan": "p10",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "13.3-RELEASE",
              "lessThan": "p6",
              "versionType": "release"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*"
          ],
          "vendor": "freebsd",
          "product": "freebsd",
          "versions": [
            {
              "status": "affected",
              "version": "14.1",
              "lessThan": "14.1_p4",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "14.0",
              "lessThan": "14.0_p10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "13.3",
              "lessThan": "13.3_p6",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-05T05:15:13.677",
  "references": [
    {
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:14.umtx.asc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secteam@freebsd.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20240916-0001/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secteam@freebsd.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        },
        {
          "lang": "en",
          "value": "CWE-911"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.\n\nA malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape."
    },
    {
      "lang": "es",
      "value": "Las eliminaciones simultáneas de ciertas asignaciones de memoria compartida anónimas mediante la subsolicitud UMTX_SHM_DESTROY de UMTX_OP_SHM pueden provocar que se reduzca el recuento de referencias del objeto que representa la asignación demasiadas veces, lo que hace que se libere demasiado pronto. Un código malicioso que ejecute la subsolicitud UMTX_SHM_DESTROY en paralelo puede provocar un pánico en el núcleo o permitir más ataques de use-after-free, que podrían incluir la ejecución de código o el escape de la zona protegida de Capsicum."
    }
  ],
  "lastModified": "2026-06-17T07:50:26.617",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E82CE719-C11D-4C34-BDF9-5AA704884289",
              "versionEndExcluding": "13.3",
              "versionStartIncluding": "13.0"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17DAE911-21E1-4182-85A0-B9F0059DDA7F"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABEA48EC-24EA-4106-9465-CE66B938635F"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DFB5BD0-E777-4CAA-B2E0-3F3357D06D01"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC8C769C-A23E-4F61-AC42-4DA64421B096"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45B0589E-2E7D-4516-A8A0-88F30038EAB0"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5CD8EF6-B119-488F-A278-8E9740E3E482"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.4:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F52349C-6051-4CB9-8659-763A22C31640"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA25530A-133C-4D7C-8993-D5C42D79A0B5"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB7B021E-F4AD-44AC-96AB-8ACAF8AB1B88"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69A72B5A-2189-4700-8E8B-1E5E7CA86C40"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5771F187-281B-4680-B562-EFC7441A8F88"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A4437F5-9DDA-4769-974E-23BFA085E0DB"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9C3A3D4-C9F4-41EB-B532-821AF83470B1"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "878A1F0A-087F-47D7-9CA5-A54BB8D6676A"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE73CDC3-B5A7-4921-89C6-8F9DC426CB3E"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50A5E650-31FB-45BE-8827-641B58A83E45"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D59CFDD3-AEC3-43F1-A620-0B1F0BAD9048"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44B8A489-6314-460D-90DA-AFB54298C8E6"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "038E5B85-7F60-4D71-8D3F-EDBF6E036CE0"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF309824-D379-4749-A1FA-BCB2987DD671"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79D770C6-7A57-4A49-8164-C55391F62301"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA813990-8C8F-4EE8-9F2B-9F73C510A7B2"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4DFA201-27D5-4C01-B90F-E24778943C3B"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01DD321B-E5E2-49F7-86A1-D40B13E257C7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secteam@freebsd.org"
}