Technical impact
The vulnerability resides in the semaphore control system call, where a sequence‑number wrap‑around allows a local unprivileged user to bypass a validation check and perform a buffer copy with a size calculated from a semaphore set that no longer exists or has a different configuration. This results in out‑of‑bounds reads or writes on the kernel heap, which can be leveraged to corrupt memory, cause a crash, or gain elevated privileges on the affected system.
Affected Systems
The affected platform is FreeBSD. No specific version numbers are supplied by the CNA; however, all recent releases before the advisory contain the vulnerable implementation of semctl(2).
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity impact, and the EPSS score of less than 1% shows a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The attack can be performed locally by an unprivileged user who rapidly creates and destroys semaphore sets to force a sequence‑number rollover, followed by exploitation of the resulting out‑of‑bounds memory operation.
