CVE-2024-6760: FreeBSD Information Disclosure Vulnerability

CVE-2024-6760 Overview

CVE-2024-6760 is a kernel logic flaw in FreeBSD that fails to disable ktrace for setuid programs under specific conditions. The defect lets unprivileged users trace setuid binaries and observe data the kernel passes through them. Attackers can use the resulting trace records to read file contents that should be restricted, including the local password database. The vulnerability is classified under CWE-862: Missing Authorization and affects multiple supported FreeBSD branches. FreeBSD published advisory FreeBSD-SA-24:06.ktrace to address the issue.

Critical Impact
Local unprivileged users can read sensitive file contents, including password database entries, by tracing setuid programs that ktrace should have stopped recording.

Affected Products

FreeBSD 13.3 (release through patch level p4)
FreeBSD 14.0 (beta5, rc3, rc4-p1, and patch levels p1 through p8)
FreeBSD 14.1 (patch levels p1 and p2)

Discovery Timeline

2024-08-12 - CVE-2024-6760 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6760

Vulnerability Analysis

FreeBSD's kernel tracing facility ktrace records system calls, signals, namei translations, and I/O for a target process. When a process executes a setuid binary, the kernel must suppress tracing so an unprivileged tracer cannot observe privileged operations. The conditional logic that performs this suppression was incorrect, leaving tracing enabled across the setuid transition. An unprivileged user who attaches ktrace to a process before it executes a setuid binary continues to receive trace records covering the privileged execution. Trace data includes buffers read from disk, allowing the attacker to recover file contents the calling user has no permission to access, such as /etc/master.passwd.

Root Cause

The root cause is a missing authorization check expressed as a logic bug [CWE-862]. The branch that determines whether to disable kernel tracing for setuid execution does not evaluate to true in cases where it must. Because tracing remains active, the kernel writes sensitive syscall arguments and I/O payloads from the privileged process into the trace file owned by the unprivileged tracer.

Attack Vector

An attacker with a local shell starts ktrace against a process they own and then invokes a setuid binary that reads sensitive files. The kernel should detach tracing at the privilege boundary but does not. The tracer reads the resulting ktrace.out with kdump and extracts the file contents from the recorded read calls. Refer to the FreeBSD Security Advisory SA-24:06 for the authoritative technical description.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose above rather than reproduced as exploit code.

Detection Methods for CVE-2024-6760

Indicators of Compromise

Unexpected ktrace.out files in user-writable directories that contain syscall records referencing setuid binaries such as passwd, su, or login.
Audit events showing unprivileged users invoking ktrace(2) immediately before executing setuid programs.
Trace dumps produced by kdump containing readable content from /etc/master.passwd or other privileged files.

Detection Strategies

Enable FreeBSD auditd with the lo,ex,fr classes to log execve of setuid binaries alongside ktrace invocations and correlate the two events per user session.
Inspect process accounting records for ktrace usage by non-root accounts followed by setuid binary execution within short time windows.
Hunt for files matching the default ktrace.out pattern in home directories and /tmp, then validate their contents against known sensitive paths.

Monitoring Recommendations

Forward FreeBSD audit logs to a centralized analytics pipeline and alert on ktrace syscalls executed by unprivileged UIDs.
Baseline legitimate developer use of ktrace so anomalous invocations targeting setuid binaries are surfaced quickly.
Track read access to /etc/master.passwd and other credential stores through file integrity and audit subsystems.

How to Mitigate CVE-2024-6760

Immediate Actions Required

Apply the FreeBSD-SA-24:06.ktrace patch to all systems running FreeBSD 13.3 or 14.x and reboot to load the updated kernel.
Inventory hosts using freebsd-version -k and prioritize multi-user systems where unprivileged shell access exists.
Rotate credentials stored in /etc/master.passwd on systems where unprivileged users had shell access before patching.

Patch Information

FreeBSD released kernel patches through FreeBSD Security Advisory SA-24:06. Administrators should run freebsd-update fetch install on supported branches and rebuild custom kernels from the patched source tree. NetApp customers should consult NetApp Advisory NTAP-20240816-0010 for product-specific guidance.

Workarounds

Disable ktrace system-wide by building a custom kernel without the KTRACE option until the patch can be deployed.
Restrict shell access on affected hosts to trusted administrative accounts to reduce the attacker population.
Set kern.ktrace_request_pool to zero or remove the ktrace binary's execute permission for non-root users as a temporary hardening step.

bash

# Apply the FreeBSD security update and reboot
freebsd-update fetch
freebsd-update install
shutdown -r now

# Verify the running kernel version after reboot
freebsd-version -k