SB2018120501 - Privilege escalation in FreeBSD
Published: December 5, 2018
Security Bulletin ID
SB2018120501
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Buffer overflow (CVE-ID: CVE-2018-17160)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the one of the device models provided by bhyve(8). A local privileged user on the guest operating system can overwrite memory within the bhyve process on the host operating system and crash the host system or execute arbitrary code with root privileges.
The vulnerability can be exploited with a UEFI image from the bhyve-firmware package.
Remediation
Install update from vendor's website.