CVE-2024-41928

Description

Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process.

PUBLISHED Reserved 2024-08-27 | Published 2024-09-05 | Updated 2024-09-20 | Assigner freebsd

Problem types

CWE-125 Out-of-bounds Read

CWE-787 Out-of-bounds Write

CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input

Product status

Credits

Synacktiv finder

The FreeBSD Foundation sponsor

The Alpha-Omega Project sponsor

References

security.netapp.com/advisory/ntap-20240920-0009/

security.freebsd.org/advisories/FreeBSD-SA-24:10.bhyve.asc vendor-advisory

cve.org (CVE-2024-41928)

nvd.nist.gov (CVE-2024-41928)

Download JSON