CVE-2024-45288: nvlist Array Buffer Overflow Vulnerability

CVE-2024-45288 Overview

CVE-2024-45288 is an out-of-bounds write vulnerability in the FreeBSD libnv library. The flaw stems from a missing null-termination character in the last element of an nvlist array string. When the library processes such an array, it writes past the allocated buffer boundary. The issue is tracked as CWE-170: Improper Null Termination and affects FreeBSD systems as documented in the FreeBSD Security Advisory SA-24:09. NetApp also confirmed exposure in its NetApp Security Advisory ntap-20240920-0008.

Critical Impact
A local attacker can trigger an out-of-bounds write in libnv, potentially leading to memory corruption, privilege escalation, or arbitrary code execution within components that parse untrusted nvlists.

Affected Products

FreeBSD (multiple supported branches; see FreeBSD-SA-24:09)
FreeBSD libnv name/value pair library
NetApp products referencing FreeBSD libnv (see ntap-20240920-0008)

Discovery Timeline

2024-09-05 - CVE-2024-45288 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45288

Vulnerability Analysis

The FreeBSD libnv library serializes and deserializes name/value pair lists (nvlist) used by kernel and userland components. Strings inside an nvlist array must be null-terminated. When the last element of an nvlist array string lacks a null terminator, libnv continues processing beyond the intended buffer boundary. This condition results in a write outside the allocated buffer.

An attacker who can supply a crafted nvlist to a privileged consumer can corrupt adjacent heap memory. Depending on the calling context, the corruption can influence control data, function pointers, or metadata used by later allocations. Because libnv is used to marshal data between userland and kernel components, exploitation can cross privilege boundaries.

Root Cause

The root cause is improper null termination [CWE-170] during handling of the final element of an nvlist array string. The parsing routine assumes the presence of a terminator that the input is not required to include. Length and boundary checks fail to compensate, so the write path extends past the buffer end.

Attack Vector

The vulnerability requires local access. An attacker with the ability to send a malicious nvlist to a component that deserializes it can trigger the out-of-bounds write. No authentication or user interaction is required beyond delivering the crafted payload. Successful exploitation compromises confidentiality, integrity, and availability of the affected component.

Refer to the FreeBSD Security Advisory SA-24:09 for the specific code path and patch diff.

Detection Methods for CVE-2024-45288

Indicators of Compromise

Unexpected crashes or kernel panics in processes or subsystems that consume nvlist data, including bhyve, libcasper, and related IPC consumers.
Heap corruption traces or SIGABRT reports referencing libnv symbols such as nvlist_unpack or nvlist_xunpack.
Unexplained privilege escalations on FreeBSD hosts following local process activity that manipulates nvlist structures.

Detection Strategies

Audit installed FreeBSD versions against the fixed releases listed in FreeBSD-SA-24:09 and flag unpatched hosts.
Enable and review core dump collection for services that parse nvlist input, correlating faults with libnv frames.
Use file integrity monitoring on /lib/libnv.so.* and related binaries to detect unauthorized replacement or downgrade.

Monitoring Recommendations

Forward system logs and crash reports from FreeBSD hosts to a centralized logging or SIEM platform for correlation.
Alert on repeated abnormal terminations of userland services that consume nvlist messages.
Track process execution and privilege transitions on FreeBSD systems to identify post-exploitation behavior following memory corruption.

How to Mitigate CVE-2024-45288

Immediate Actions Required

Apply the FreeBSD patches referenced in FreeBSD-SA-24:09 to all affected releases.
For NetApp products, follow remediation steps in ntap-20240920-0008.
Restart affected services or reboot systems after patching so processes load the fixed libnv binary.
Restrict local access on FreeBSD hosts until patches are installed.

Patch Information

FreeBSD published fixes in SA-24:09 for supported release branches. Update the base system using freebsd-update fetch install on binary-update-managed systems, or rebuild from source at the patched revision. Confirm the patched libnv is in use by verifying the version of the base system and restarting long-running services that link against it.

Workarounds

Limit local user accounts and remove unnecessary shell access on affected FreeBSD hosts.
Constrain the attack surface of services that consume nvlist input by using jails, capsicum, or MAC policies to isolate them.
Disable non-essential subsystems that unpack untrusted nvlist data until the patch is applied.

bash

# Update FreeBSD to a patched release
freebsd-update fetch
freebsd-update install

# Verify the patched userland is active
freebsd-version -u

# Reboot to ensure all consumers reload libnv
shutdown -r now