PT-2023-25067 · Bhyve+1 · Bhyve+1

Omri Ben Bassat + 1 · Published 2023-08-01 · Updated 2023-08-31 · CVE-2023-3494

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bhyve (affected versions not specified)

Description A bug in the state machine implementation of the fwctl driver can result in a buffer overflowing when a guest VM copies a string into a buffer in the bhyve process' memory. This can be exploited by malicious, privileged software running in a guest VM to achieve code execution on the host in the bhyve userspace process, which typically runs as root. The risk is mitigated by the capabilities assigned through the Capsicum sandbox available to the bhyve process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2023-3494

FREEBSD-SA-23_07

Affected Products

Freebsd

Bhyve

References · 5

• https://osv.dev/vulnerability/CVE-2023-3494 · Vendor Advisory
• https://security.freebsd.org/advisories/FreeBSD-SA-23:07.bhyve.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3494 · Security Note
• https://security.netapp.com/advisory/ntap-20230831-0006 · Note
• https://t.me/cvenotify/56009 · Telegram Post