Unprivileged Users Can Access Restricted Data via Logic Bug in Kernel Tracing

CVE-2024-6760

What is CVE-2024-6760?

The vulnerability presents a logic flaw in the FreeBSD operating system related to the kernel tracing functionality of setuid programs. The flaw permits unprivileged users to trace and interact with the execution of setuid programs due to improper disabling of kernel tracing mechanisms. This oversight allows unauthorized users to access sensitive information, including the contents of files that should remain out of reach, such as the local password database. Mitigation efforts are necessary to prevent unprivileged access to critical system resources.

References