PT-2023-12712 · Bhyve+1 · Bhyve+1

Mehdi Talbi + 1 · Publicado 2022-04-06 · Atualizado 2024-12-09 · CVE-2022-23087

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bhyve (affected versions not specified)

Description The e1000 network adapters allow modifications to Ethernet packets during transmission, including IP and TCP checksum insertion, Ethernet VLAN header insertion, and TCP segmentation offload. The e1000 device model uses an on-stack buffer to generate modified packet headers. When checksum offload is requested for a transmitted packet, the e1000 device model uses a guest-provided value to specify the checksum offset in the on-stack buffer, which was not validated for certain packet types. A misbehaving bhyve guest could overwrite memory in the bhyve process on the host, possibly leading to code execution in the host context. The bhyve process runs in a Capsicum sandbox, which limits the impact of exploiting this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2022-23087

FREEBSD-SA-22_05

Produtos afetados

Freebsd

Bhyve

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-23087 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-23087 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/7492 · Publicação no Telegram
• https://t.me/freedomf0x/18803 · Publicação no Telegram
• https://t.me/cvenotify/71482 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1757997074510196875 · Publicação no Twitter
• https://security.freebsd.org/advisories/FreeBSD-SA-22:05.bhyve.asc · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20240415-0005 · Nota