In a recent discovery, a critical vulnerability (CVE-2024-29937) in the NFS server used by BSD systems has been exposed. This vulnerability allows for remote execution of Root code on the server. The issue affects all OpenBSD and FreeBSD versions up to OpenBSD 7.4 and FreeBSD 14.0-Release. While specific details about the vulnerability have not been revealed, it is known that the flaw stems from a logical error unrelated to memory corruption.
The vulnerability poses a significant threat as it can be easily exploited to attack systems using NFS. A video demonstration shows that the vulnerability provides full access to the server’s file system and requires permissions to mount partitions via NFS. A report detailing the nature of the vulnerability will be presented on April 18 at the T2’24 conference.