CyberRota Analysis
AI-GeneratedThe vulnerability arises from improper reference counting in the kern_jail_set() and kern_jail_get() functions when the JAIL_AT_DESC flag is used, allowing an unprivileged local user to trigger a reference count underflow. This can lead to the premature freeing of the prison structure, potentially causing a system panic on the jail host or enabling privilege escalation within a jail environment. System administrators and security teams managing jails should prioritize this issue to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.
Related CVEs
Other vulnerabilities affecting the same vendor(s)