{"id":"CVE-2024-43102","aliases":["EUVD-2024-40036","GHSA-v72r-7947-x8jx"],"status":"published","title":"umtx Kernel panic or Use-After-Free","description":"Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.\n\nA malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00687,"percentile":0.53114,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-416","CWE-911"],"published":"2024-09-05T04:54:52Z","modified":"2026-11-04T00:31:29Z","products":[{"vendor":"freebsd","product":"freebsd"}],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-24:14.umtx.asc","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240916-0001/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43102"},{"url":"https://security.netapp.com/advisory/ntap-20240916-0001"},{"url":"https://github.com/advisories/GHSA-v72r-7947-x8jx"}],"sources":{"cve":[{"id":"CVE-2024-43102","title":"umtx Kernel panic or Use-After-Free","description":"Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.\n\nA malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.","status":"published","published":"2024-09-05T04:54:52.452Z","modified":"2026-11-04T00:03:06.327Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-416","CWE-911"],"updated_at":"2026-11-04T00:47:47.540303Z"}],"euvd":[{"id":"EUVD-2024-40036","description":"Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.\n\nA malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.","status":"published","published":"2024-09-05T04:54:52Z","modified":"2026-11-04T00:03:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T01:51:27.299093Z"}],"ghsa":[{"id":"GHSA-v72r-7947-x8jx","title":"Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub...","description":"Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.\n\nA malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.","status":"published","published":"2024-09-05T06:31:35Z","modified":"2026-11-04T00:31:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-04T00:48:21.284682Z"}],"nvd":[{"id":"CVE-2024-43102","description":"Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.\n\nA malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.","status":"published","published":"2024-09-05T05:15:13.677Z","modified":"2026-11-04T00:17:21.007Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-416","CWE-911"],"updated_at":"2026-11-04T01:48:25.983714Z"}]}}