CVE-2024-43102

CriticalCVSS 10.0/10Last modified Nov 4, 2026

Description

Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.

A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-416 CWE-911

Affected software

Vendor	Product	Versions
FreeBSD	FreeBSD	>= 14.1-RELEASE, < p4; >= 14.0-RELEASE, < p10; >= 13.3-RELEASE, < p6
freebsd	freebsd	>= 14.1, < 14.1_p4; >= 14.0, < 14.0_p10; >= 13.3, < 13.3_p6

References

Timeline

Published: Sep 5, 2024
Last modified: Nov 4, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-431054.3Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume exc CVE-2024-431069.1A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage Excel's access privile CVE-2024-431077.2Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm e CVE-2024-431086.5The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms CVE-2024-43115.4zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An atta CVE-2024-431108.8The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM tha CVE-2024-431116.1Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Fi CVE-2024-431126.1Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129 CVE-2024-431136.1The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129 CVE-2024-431147.8In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions CVE-2024-431158.8Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert scrip CVE-2024-431168.8Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.1