CVE-2024-32668
bhyve(8) privileged guest escape via USB controller
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
bhyve(8) privileged guest escape via USB controller
| Assigner | freebsd |
| Reserved | 2024-08-27 |
| Published | 2024-09-05 |
| Updated | 2024-09-05 |
An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A malicious, privileged software running in a guest VM can exploit the vulnerability to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process.
Synacktiv
The FreeBSD Foundation
The Alpha-Omega Project
https://security.freebsd.org/advisories/FreeBSD-SA-24:12.bhyve.asc
