PT-2023-12712 · Bhyve+1 · Bhyve+1

Mehdi Talbi + 1 · Published 2022-04-06 · Updated 2024-12-09 · CVE-2022-23087

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bhyve (affected versions not specified)

Description The e1000 network adapters allow modifications to Ethernet packets during transmission, including IP and TCP checksum insertion, Ethernet VLAN header insertion, and TCP segmentation offload. The e1000 device model uses an on-stack buffer to generate modified packet headers. When checksum offload is requested for a transmitted packet, the e1000 device model uses a guest-provided value to specify the checksum offset in the on-stack buffer, which was not validated for certain packet types. A misbehaving bhyve guest could overwrite memory in the bhyve process on the host, possibly leading to code execution in the host context. The bhyve process runs in a Capsicum sandbox, which limits the impact of exploiting this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-23087

FREEBSD-SA-22_05

Affected Products

Freebsd

Bhyve

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-23087 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23087 · Vendor Advisory
• https://security.freebsd.org/advisories/FreeBSD-SA-22:05.bhyve.asc · Vendor Advisory
• https://t.me/cybersecuritytechnologies/7492 · Telegram Post
• https://t.me/freedomf0x/18803 · Telegram Post
• https://t.me/cvenotify/71482 · Telegram Post
• https://twitter.com/CVEnew/status/1757997074510196875 · Twitter Post
• https://security.netapp.com/advisory/ntap-20240415-0005 · Note