PT-2024-1718 · Freebsd · Freebsd

Pawel Jakub Dawidek · Published 2024-02-14 · Updated 2025-06-04 · CVE-2024-25941

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD (affected versions not specified)

Description The issue is related to incorrect process locking in the jail(2) system call, which can lead to an information leak about processes outside the current jail. An attacker can exploit this to gain unauthorized access to protected information. The vulnerability allows an attacker to get information about TTYs allocated on the host or in other jails, effectively leaking information that may be printed by "pstat -t".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

BDU:2024-01422

CVE-2024-25941

FREEBSD-SA-24_02

Affected Products

Freebsd

References · 12

• https://bdu.fstec.ru/vul/2024-01422 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25941 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-24:02.tty.asc · Vendor Advisory
• https://en.wikipedia.org/wiki/FreeBSD_jail · Note
• https://t.me/cvenotify/124676 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-24:02.tty.asc · Note
• https://twitter.com/CVEnew/status/1757987533726863390 · Twitter Post
• https://t.me/cvenotify/102216 · Telegram Post
• https://tenable.com/plugins/nessus/190576 · Note
• https://t.me/cvenotify/82655 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240510-0003 · Note