Decreasing Reference Count Leads to Object Freedom, But Too Many Times Can Cause Panic or Use-After-Free Attacks

CVE-2024-43102

What is CVE-2024-43102?

A vulnerability exists in FreeBSD's shared memory management, particularly concerning the concurrent usage of the UMTX_SHM_DESTROY sub-request within UMTX operations. Attackers can exploit this flaw by triggering concurrent removals of anonymous shared memory mappings, which can erroneously decrement the reference count of the associated mapping object. This issue can lead to premature deallocation of shared memory, causing critical stability issues such as kernel panic. Moreover, it heightens the risk of Use-After-Free vulnerabilities, enabling potential code execution and circumvention of the Capsicum sandboxing mechanism.

References