CVE-2024-6760

Published: Aug 12, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users to trace and inspect the behavior of setuid programs. The bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database.

Affected (19)

Products: Freebsd: Freebsd

Freebsd

1 product

Freebsd

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Before 13.0
Freebsd Freebsd	From 13.1 to 13.3
Freebsd Freebsd	Version 13.3 p1
Freebsd Freebsd	Version 13.3 p2
Freebsd Freebsd	Version 13.3 p3
Freebsd Freebsd	Version 13.3 p4
Freebsd Freebsd	Version 14.0 beta5
Freebsd Freebsd	Version 14.0 p1
Freebsd Freebsd	Version 14.0 p2
Freebsd Freebsd	Version 14.0 p3
Freebsd Freebsd	Version 14.0 p4
Freebsd Freebsd	Version 14.0 p5
Freebsd Freebsd	Version 14.0 p6
Freebsd Freebsd	Version 14.0 p7
Freebsd Freebsd	Version 14.0 p8
Freebsd Freebsd	Version 14.0 rc3
Freebsd Freebsd	Version 14.0 rc4-p1
Freebsd Freebsd	Version 14.1 p1
Freebsd Freebsd	Version 14.1 p2

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://security.freebsd.org/advisories/FreeBSD-SA-24:06.ktrace.asc

Source: secteam@freebsd.org

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240816-0010/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.