CVE-2024-45287 Overview
CVE-2024-45287 is an integer overflow vulnerability in FreeBSD's libnv library. The flaw exists in the parsing logic for packed name/value (nv) data structures. A malicious size value in a packed libnv structure triggers an arithmetic overflow during buffer size calculation. The result is allocation of a buffer smaller than the data subsequently written into it, producing a heap-based buffer overflow condition. The vulnerability affects FreeBSD 13.3 and 14.0 through 14.1 release branches. FreeBSD assigned advisory FreeBSD-SA-24:09.libnv to track this issue.
Critical Impact
Network-reachable attackers can supply crafted packed nvlist data to trigger heap corruption, leading to denial of service of affected FreeBSD systems and components that consume untrusted libnv data.
Affected Products
- FreeBSD 13.3 (including patch levels p1 through p5)
- FreeBSD 14.0 (including patch levels p1 through p9, beta5, rc3, rc4-p1)
- FreeBSD 14.1 (including patch levels p1 through p3)
Discovery Timeline
- 2024-09-05 - CVE-2024-45287 published to NVD alongside FreeBSD Security Advisory SA-24:09
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-45287
Vulnerability Analysis
The libnv library implements name/value pair lists used throughout FreeBSD for inter-process communication, kernel-userland interfaces, and capability frameworks such as Capsicum. Packed nvlists are serialized representations that can be transmitted over sockets, pipes, or shared memory. The unpack routines read length fields embedded in attacker-controlled data and use those values to size destination buffers.
When an attacker supplies a maliciously large size value, an arithmetic operation, typically the addition of a header length or alignment padding, overflows the integer type used to compute the allocation size. The wrapped result produces a small allocation, while the subsequent copy uses the original large length. The mismatch corrupts adjacent heap memory. The weakness is categorized under [CWE-190] Integer Overflow and [CWE-131] Incorrect Calculation of Buffer Size.
Root Cause
The defect originates in libnv size arithmetic that does not validate the size field against the maximum representable allocation length before computing the destination buffer size. No bounds check rejects values that would overflow the size computation. The library trusts the embedded length without comparing it against the actual remaining input length.
Attack Vector
Any FreeBSD component that deserializes untrusted packed nvlists is reachable through this flaw. Network services, privileged daemons receiving IPC messages, and kernel interfaces accepting nvlist input represent the primary attack surface. An attacker requires no authentication and no user interaction. Successful exploitation produces heap corruption that reliably crashes the consuming process or kernel path.
No verified public proof-of-concept code is published. Technical details appear in the FreeBSD Security Advisory SA-24:09 and the NetApp Security Advisory ntap-20240926-0010.
Detection Methods for CVE-2024-45287
Indicators of Compromise
- Unexpected crashes or core dumps in processes that consume packed nvlist data, including jails, Capsicum-sandboxed binaries, and bhyve guests
- Kernel panics referencing libnv or nvlist_unpack call stacks
- Repeated process restarts of FreeBSD services that exchange nvlists over sockets or descriptors
Detection Strategies
- Inventory FreeBSD hosts and compare installed kernel and userland versions against the fixed patch levels listed in FreeBSD-SA-24:09.libnv
- Monitor system logs (/var/log/messages, dmesg) for repeated segmentation faults or kernel traps in services that parse nvlists
- Apply vulnerability scanning that maps CPE identifiers for FreeBSD 13.3 and 14.0/14.1 patch levels against the advisory's fixed versions
Monitoring Recommendations
- Forward FreeBSD syslog and crash reports to a centralized logging platform for correlation across hosts
- Alert on anomalous restart patterns of network-facing daemons and jail processes that handle untrusted input
- Track outbound traffic from FreeBSD hosts for signs of post-crash recovery loops indicating attempted exploitation
How to Mitigate CVE-2024-45287
Immediate Actions Required
- Apply the FreeBSD patches documented in FreeBSD-SA-24:09.libnv to all affected 13.3, 14.0, and 14.1 systems
- Reboot systems after upgrading the kernel and rebuild dependent third-party software that statically links libnv
- For appliances built on FreeBSD, including NetApp ONTAP-based products, consult vendor advisories and apply vendor-supplied updates
Patch Information
FreeBSD published fixes through the freebsd-update mechanism and source patches referenced in FreeBSD Security Advisory SA-24:09. Downstream vendors including NetApp have issued coordinated advisories with platform-specific guidance in NetApp Security Advisory ntap-20240926-0010.
Workarounds
- No official workaround exists; the advisory states that patching is required
- Restrict network exposure of services that deserialize nvlists from untrusted sources until patches are applied
- Enforce strict access controls on IPC channels and sockets used by privileged daemons that consume packed nvlist data
# Apply FreeBSD security updates
freebsd-update fetch
freebsd-update install
# Verify patched version after reboot
uname -a
freebsd-version -k -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
