FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- bhyve(8) out-of-bounds read access via XHCI emulation

Affected packages
14.1 <= FreeBSD < 14.1_5
14.0 <= FreeBSD < 14.0_11
13.4 <= FreeBSD < 13.4_1
13.3 <= FreeBSD < 13.3_7

Details

VuXML ID 1febd09b-7716-11ef-9a62-002590c1f29c
Discovery 2024-09-19
Entry 2024-09-20

Problem Description:

bhyve can be configured to emulate devices on a virtual USB controller (XHCI), such as USB tablet devices. An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and remote code execution.

Impact:

A malicious, privileged software running in a guest VM can exploit the vulnerability to crash the hypervisor process or potentially achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process.

References

CVE Name CVE-2024-41721
FreeBSD Advisory SA-24:15.bhyve