Technical impact
The vulnerability originates from an unchecked PRIV_KTRACE permission for users in a FreeBSD jail. A jailed root user never receives the required privileged flag for ktrace(2), so on a jail the root’s ktrace status can be altered by any unprivileged user granted delete or debug rights to the target process. This flaw allows an unprivileged user to change or disable ktrace monitoring for a root‑owned process, effectively bypassing the intended isolation and enabling the user to observe or interfere with the process. The weakness is a privilege validation error (CWE‑273), which can lead to unauthorized monitoring or manipulation of a jailed root instance, potentially leaking confidential information or destabilizing the environment.
Affected Systems
This issue affects FreeBSD systems running any jail configuration where unprivileged users are granted debug or inspection privileges on processes owned by the jailed root. No specific product version range is listed, so all FreeBSD releases susceptible to the privilege bypass are impacted until the patch is applied.
Risk and Exploitability
EPSS score of <1% indicates a low probability of exploitation in the wild. The CVSS score of 8.1 indicates high severity. However, the flaw involves a privileged escalation within a jail—a trusted boundary—where an attacker already present as an unprivileged user in the jail can exploit the bug. The vulnerability is not listed in CISA KEV catalog. A likely attack vector involves existing debug permissions to manipulate ktrace flags and gain information otherwise reserved for root.
