#VU16236 Buffer overflow in FreeBSD - CVE-2018-17160
Published: December 5, 2018
Vulnerability identifier: #VU16236
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-17160
CWE-ID: CWE-119
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerable software:
FreeBSD
FreeBSD
Software vendor:
FreeBSD Foundation
FreeBSD Foundation
Description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the one of the device models provided by bhyve(8). A local privileged user on the guest operating system can overwrite memory within the bhyve process on the host operating system and crash the host system or execute arbitrary code with root privileges.
The vulnerability can be exploited with a UEFI image from the bhyve-firmware package.
Remediation
Install updates from vendor's website.