PT-2024-2366 · Openbsd+1 · Openbsd+1

Nextgens · Published 2024-03-21 · Updated 2025-03-13 · CVE-2024-29937

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenBSD versions through 7.4 FreeBSD versions through 14.0-RELEASE

Description The issue is related to a bug in the Network File System (NFS) implementation used in OpenBSD and FreeBSD, allowing remote attackers to execute arbitrary code via a logical error unrelated to memory corruption. This bug can be exploited to gain root privileges on the server. The vulnerability is present in all releases of OpenBSD and FreeBSD up to OpenBSD 7.4 and FreeBSD 14.0-RELEASE. It is noted that the vulnerability can be easily exploited and used to attack systems that use NFS, requiring the ability to mount NFS partitions.

Recommendations For OpenBSD versions through 7.4, update to a newer version that contains a fix for this issue. For FreeBSD versions through 14.0-RELEASE, update to a newer version that contains a fix for this issue. As a temporary workaround, consider limiting NFS access and monitoring network activity until a patch is available. Restrict access to the NFS server to minimize the risk of exploitation.

Exploit

Fix

Code Injection

RCE

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

BDU:2024-02317

CVE-2024-29937

Affected Products

Freebsd

Openbsd

References · 21

• 🔥 https://youtube.com/watch?v=i_JOkHaCdzk · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-29937 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29937 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02317 · Security Note
• https://youtu.be/i_JOkHaCdzk · Note
• https://t.me/cvenotify/114671 · Telegram Post
• https://twitter.com/fletch_ai/status/1772475329359085627 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1772202182722674707 · Twitter Post
• https://t.me/pentestingnews/45103 · Telegram Post
• https://twitter.com/jedisct1/status/1772613271146660193 · Twitter Post
• https://securityonline.info/cve-2024-29937-critical-nfs-vulnerability-exposes-bsd-systems-to-remote-code-execution · Note
• https://twitter.com/Komodosec/status/1772261447688761639 · Twitter Post
• https://t.me/tmfeed/196745 · Telegram Post
• https://twitter.com/CVEnew/status/1770877716780417073 · Twitter Post
• https://opennet.ru/opennews/art.shtml?num=60845 · Note