CVE-2024-43110 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.

Reserved 2024-08-27 | Published 2024-09-05 | Updated 2024-09-05 | Assigner freebsd

Problem types

CWE-125 Out-of-bounds Read

Product status

Default status

unknown

14.1-RELEASE before p4

affected

14.0-RELEASE before p10

affected

13.3-RELEASE before p6

affected

Credits

Synacktiv finder

The FreeBSD Foundation sponsor

The Alpha-Omega Project sponsor

References

security.freebsd.org/advisories/FreeBSD-SA-24:11.ctl.asc vendor-advisory

cve.org (CVE-2024-43110)

nvd.nist.gov (CVE-2024-43110)

Download JSON

https://cve.threatint.com/CVE/CVE-2024-43110

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.