Vulnerability identifier: #VU46744

Vulnerability risk: Medium

CVSSv3.1: 7.4 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-7467

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
FreeBSD
Operating systems & Components / Operating system

Vendor: FreeBSD Foundation

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists in bhyve(8) hypervisor when processing instructions for AMD procesors sent from guest operating environmentas a number of AMD virtualization instructions operate on host physical addresses, are not subject to nested page table translation, and guest use of these instructions is not trapped.

A remote user with access to guest operating system can run a specially crafted program to write to arbitrary memory locations on the host operating system.

Successful exploitation of the vulnerability may allow an attacker to gain full control over the  host operating system.

Note, the vulnerability affects systems running bhyve(8) on AMD processors only.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

FreeBSD: 11.0 - 12.2

---

External links
http://www.freebsd.org/security/advisories/FreeBSD-SA-20:29.bhyve_svm.asc

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.