Products
bhyve
freebsd
- *
freebsd
- 1
- 3
- .
- 3
freebsd
- 1
- 3
- .
- 4
freebsd
- 1
- 4
- .
- 0
freebsd
- 1
- 4
- .
- 1
Source
secteam@freebsd.org
Tags
CVE-2024-8178 details
Last Modified : Sept. 5, 2024, 9:21 p.m.
Description
The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8.8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | The product uses or accesses a resource that has not been initialized. |
| CWE-909 | Missing Initialization of Resource | The product does not initialize a critical resource. |
CVSS Data
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
8.8
Exploitability Score
2.0
Impact Score
6.0
Base Severity
HIGH
Vector String : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-24:11.ctl.asc | secteam@freebsd.org |
CPEs
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| o | freebsd | freebsd | / | / | / | / | / | / | / | / |
| o | freebsd | freebsd | 13.3 | - | / | / | / | / | / | / |
| o | freebsd | freebsd | 13.3 | p1 | / | / | / | / | / | / |
| o | freebsd | freebsd | 13.3 | p2 | / | / | / | / | / | / |
| o | freebsd | freebsd | 13.3 | p3 | / | / | / | / | / | / |
| o | freebsd | freebsd | 13.3 | p4 | / | / | / | / | / | / |
| o | freebsd | freebsd | 13.3 | p5 | / | / | / | / | / | / |
| o | freebsd | freebsd | 13.4 | beta3 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | - | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | beta5 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | p1 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | p2 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | p3 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | p4 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | p5 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | p6 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | p7 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | p8 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | p9 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | rc3 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.0 | rc4-p1 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.1 | - | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.1 | p1 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.1 | p2 | / | / | / | / | / | / |
| o | freebsd | freebsd | 14.1 | p3 | / | / | / | / | / | / |