CVE-2024-8178

Published Sep 5, 2024

Last updated 2 months ago

CVSS high 8.8

Overview

Description: The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.
Source: secteam@freebsd.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 6
Exploitability score: 2
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-909
secteam@freebsd.org: CWE-908

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E82CE719-C11D-4C34-BDF9-5AA704884289",
            "versionEndExcluding": "13.3",
            "versionStartIncluding": "13.0"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "17DAE911-21E1-4182-85A0-B9F0059DDA7F"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ABEA48EC-24EA-4106-9465-CE66B938635F"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8DFB5BD0-E777-4CAA-B2E0-3F3357D06D01"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BC8C769C-A23E-4F61-AC42-4DA64421B096"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "45B0589E-2E7D-4516-A8A0-88F30038EAB0"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C5CD8EF6-B119-488F-A278-8E9740E3E482"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:13.4:beta3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2F52349C-6051-4CB9-8659-763A22C31640"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FA25530A-133C-4D7C-8993-D5C42D79A0B5"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DB7B021E-F4AD-44AC-96AB-8ACAF8AB1B88"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "69A72B5A-2189-4700-8E8B-1E5E7CA86C40"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5771F187-281B-4680-B562-EFC7441A8F88"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0A4437F5-9DDA-4769-974E-23BFA085E0DB"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A9C3A3D4-C9F4-41EB-B532-821AF83470B1"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "878A1F0A-087F-47D7-9CA5-A54BB8D6676A"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CE73CDC3-B5A7-4921-89C6-8F9DC426CB3E"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "50A5E650-31FB-45BE-8827-641B58A83E45"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p8:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D59CFDD3-AEC3-43F1-A620-0B1F0BAD9048"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p9:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "44B8A489-6314-460D-90DA-AFB54298C8E6"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "038E5B85-7F60-4D71-8D3F-EDBF6E036CE0"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BF309824-D379-4749-A1FA-BCB2987DD671"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "79D770C6-7A57-4A49-8164-C55391F62301"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AA813990-8C8F-4EE8-9F2B-9F73C510A7B2"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D4DFA201-27D5-4C01-B90F-E24778943C3B"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "01DD321B-E5E2-49F7-86A1-D40B13E257C7"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References