CVE-2024-42416
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
05/09/2024
Last modified:
05/09/2024
Description
The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory.<br />
<br />
Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* | 13.0 (including) | 13.3 (excluding) |
cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:13.3:p4:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:13.3:p5:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:13.4:beta3:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page