### [CVE-2024-43102](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43102)
![](https://img.shields.io/static/v1?label=Product&message=FreeBSD&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=13.3%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=13.3-RELEASE%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=14.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=14.0-RELEASE%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=14.1%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=14.1-RELEASE%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%20Use%20After%20Free&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-911%20Improper%20Update%20of%20Reference%20Count&color=brightgreen)

### Description

Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/PS5Dev/PS5-UMTX-Jailbreak
- https://github.com/fkie-cad/nvd-json-data-feeds
- https://github.com/tanjiti/sec_profile