PT-2020-15829 · Intel+4 · Intel+5

Published 2020-09-15 · Updated 2022-01-01 · CVE-2020-24718

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bhyve versions prior to the fixed version in FreeBSD through 12.1 bhyve as used in illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04)

Description The issue is related to the improper restriction of VMCS and VMCB read/write operations. This can be exploited by a root user in a container on an Intel system to gain privileges by modifying VMCS HOST RIP.

Recommendations For bhyve as used in FreeBSD through 12.1, update to a version that includes the fix for this issue. For bhyve as used in illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), consider restricting access to VMCS and VMCB operations until a patch is available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-24718

FREEBSD-SA-20_28

Affected Products

Freebsd

Intel

Omnios Ce

Openindiana

Bhyve

Illumos

References · 6

• 🔥 https://github.com/illumos/illumos-gate/blob/84971882a96ac0fecd538b02208054a872ff8af3/usr/src/uts/i86pc/io/vmm/intel/vmcs.c#L246-L249 · Exploit
• https://osv.dev/vulnerability/CVE-2020-24718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24718 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-20:28.bhyve_vmcs.asc · Vendor Advisory
• https://freebsd.org/security/advisories/FreeBSD-SA-20:28.bhyve_vmcs.asc · Note
• https://security.netapp.com/advisory/ntap-20201016-0002 · Note