PT-2021-12656 · Freebsd · Freebsd

Published 2020-09-15 · Updated 2021-04-01 · CVE-2020-7467

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 12.2-STABLE before r365767 FreeBSD versions 11.4-STABLE before r365769 FreeBSD versions 12.1-RELEASE before p10 FreeBSD versions 11.4-RELEASE before p4 FreeBSD versions 11.3-RELEASE before p14

Description: A number of AMD virtualization instructions in FreeBSD operate on host physical addresses and are not subject to nested page table translation. Guest use of these instructions was not trapped, which could lead to potential security issues.

Recommendations: For FreeBSD versions 12.2-STABLE before r365767, update to a version after r365767. For FreeBSD versions 11.4-STABLE before r365769, update to a version after r365769. For FreeBSD versions 12.1-RELEASE before p10, update to a version after p10. For FreeBSD versions 11.4-RELEASE before p4, update to a version after p4. For FreeBSD versions 11.3-RELEASE before p14, update to a version after p14.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-7467

FREEBSD-SA-20_29

Affected Products

Freebsd

References · 7

• https://osv.dev/vulnerability/CVE-2020-7467 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7467 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-20:29.bhyve_svm.asc · Vendor Advisory
• https://t.me/cvenotify/12136 · Telegram Post
• https://t.me/cvenotify/12181 · Telegram Post
• https://t.me/cvenotify/12216 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-20:29.bhyve_svm.asc · Note