Buffer overflow in FreeBSD - CVE-2018-17160
Published: December 5, 2018
Vulnerability identifier: #VU16236
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-17160
CWE-ID: CWE-119
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vendor: FreeBSD Foundation
Affected software:
FreeBSD
FreeBSD
Detailed vulnerability description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the one of the device models provided by bhyve(8). A local privileged user on the guest operating system can overwrite memory within the bhyve process on the host operating system and crash the host system or execute arbitrary code with root privileges.
The vulnerability can be exploited with a UEFI image from the bhyve-firmware package.
How to mitigate CVE-2018-17160
Install updates from vendor's website.