Security restrictions bypass in FreeBSD - CVE-2020-7467

Detailed vulnerability description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists in bhyve(8) hypervisor when processing instructions for AMD procesors sent from guest operating environmentas a number of AMD virtualization instructions operate on host physical addresses, are not subject to nested page table translation, and guest use of these instructions is not trapped.

A remote user with access to guest operating system can run a specially crafted program to write to arbitrary memory locations on the host operating system.

Successful exploitation of the vulnerability may allow an attacker to gain full control over the  host operating system.

Note, the vulnerability affects systems running bhyve(8) on AMD processors only.

How to mitigate CVE-2020-7467

Sources

• https://www.freebsd.org/security/advisories/FreeBSD-SA-20:29.bhyve_svm.asc