Remote code execution in FreeBSD bhyve device models



Published: 2021-08-25
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2021-29631
CWE-ID CWE-119
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
FreeBSD
Operating systems & Components / Operating system

Vendor FreeBSD Foundation

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Buffer overflow

EUVDB-ID: #VU56091

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-29631

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to improper error handling in bhyve(8) hypervisor when fetching I/O descriptors in certain VirtIO-based device models. A remote guest can run a specially crafted program to trigger memory corruption and execute arbitrary code in context of the bhyve process on the host OS.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

FreeBSD: 11.0 - 13.0

External links

http://www.freebsd.org/security/advisories/FreeBSD-SA-21:13.bhyve.asc


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###