A critical vulnerability (CVE-2024-29937) has been identified in the implementation of the NFS server used by BSD systems, which allows you to remotely execute your code with root rights on the server.
The problem appears in all OpenBSD and FreeBSD releases, up to and including OpenBSD 7.4 and FreeBSD 14.0-RELEASE. Detailed information about the vulnerability has not yet been disclosed, but it is only known that the problem is caused by a logical error that is not related to memory corruption. It is noted that the vulnerability can easily be exploited and used to attack systems that use NFS, but judging by the video demonstration, the vulnerability allows full access to the root FS of the server and requires permissions to mount partitions using NFS.
A report on the essence of the vulnerability will be presented on April 18 at the T2’24 conference.
• Video:
The problem appears in all OpenBSD and FreeBSD releases, up to and including OpenBSD 7.4 and FreeBSD 14.0-RELEASE. Detailed information about the vulnerability has not yet been disclosed, but it is only known that the problem is caused by a logical error that is not related to memory corruption. It is noted that the vulnerability can easily be exploited and used to attack systems that use NFS, but judging by the video demonstration, the vulnerability allows full access to the root FS of the server and requires permissions to mount partitions using NFS.
A report on the essence of the vulnerability will be presented on April 18 at the T2’24 conference.
• Video:
