CVEvulnerability

CVE-2024-6760

7.5 HIGH Published 2024-08-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-08-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862

Description

A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users to trace and inspect the behavior of setuid programs. The bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database.

Affected configurations

• freebsd freebsd (< 13.0) • freebsd freebsd (>= 13.1 < 13.3) • freebsd freebsd 13.3 • freebsd freebsd 14.0 • freebsd freebsd 14.1

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References