CVE-2024-41928 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Assigner	freebsd
Reserved	2024-08-27
Published	2024-09-05
Updated	2024-09-06

Description

Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process.

Problem types

CWE-125 Out-of-bounds Read

CWE-787 Out-of-bounds Write

CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input

Product status

Default status

0x40033b53f0

14.1-RELEASE before p4

affected

14.0-RELEASE before p10

affected

Credits

Synacktiv 0x40033b5470

The FreeBSD Foundation 0x40033b5480

The Alpha-Omega Project 0x40033b5490

References

https://security.freebsd.org/advisories/FreeBSD-SA-24:10.bhyve.asc vendor-advisory

cve.org CVE-2024-41928

nvd.nist.gov CVE-2024-41928

Download JSON

https://cve.threatint.com/CVE/CVE-2024-41928

Subscribe to our newsletter to learn more about our work.