PT-2024-28419 · Freebsd · Freebsd

Synacktiv · Published 2024-10-29 · Updated 2025-01-10 · CVE-2024-39281

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions FreeBSD (affected versions not specified)

Description The issue allows the caller to specify an arbitrary size using the ctl persistent reserve out command, which will be passed to the kernel's memory allocator. This could potentially lead to unbounded allocation in the ctl(4) CAM Target Layer. There is a mention of potential exploitation over unauthenticated iSCSI connections, but no further details are provided.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-39281

FREEBSD-SA-24_18

Affected Products

Freebsd

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-39281 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-24:18.ctl.asc · Vendor Advisory
• https://twitter.com/CVEnew/status/1856355640773321150 · Twitter Post
• https://t.me/cvenotify/102613 · Telegram Post
• https://t.me/cvedetector/10625 · Telegram Post
• https://t.me/cvenotify/107021 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-24:18.ctl.asc · Note
• https://twitter.com/FlorianHeigl1/status/1860765297759699050 · Twitter Post
• https://security.netapp.com/advisory/ntap-20250110-0002 · Note