CVE-2022-23092
Severity CVSS v4.0:
Pending analysis
Type:
CWE-787
Out-of-bounds Write
Publication date:
15/02/2024
Last modified:
04/06/2025
Description
The implementation of lib9p&#39;s handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory.<br />
<br />
The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process. This could potentially lead to user-mode code execution on the host, subject to bhyve&#39;s Capsicum sandbox.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:freebsd:freebsd:13.0:beta1:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:beta2:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:beta3:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:beta3-p1:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:beta4:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:p1:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:p10:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:p11:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:p2:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:p3:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:p4:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:p5:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:p6:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:p7:*:*:*:*:*:* | ||
| cpe:2.3:o:freebsd:freebsd:13.0:p8:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page