SB2024103151 - Multiple vulnerabilities in FreeBSD bhyve
Published: October 31, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2024-51562)
The vulnerability allows a malicious guest to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the nvme_opc_get_log_page() function in the NVMe driver in bhyve(8). A malicious guest can trigger an out-of-bounds read error and read contents of memory on the hypervisor.
2) Race condition (CVE-ID: CVE-2024-51563)
The vulnerability allows a malicious guest to compromise the hypervisor.
The vulnerability exists due to a race condition within the virtio_vq_recordon() function in bhyve(8). A malicious guest can exploit the race and gain unauthorized access to sensitive information or execute arbitrary code on the hypervisor.
3) Infinite loop (CVE-ID: CVE-2024-51564)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the HDA audio driver. A malicious guest can consume all available system resources and cause denial of service conditions.
4) Infinite loop (CVE-ID: CVE-2024-51565)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the NVMe driver. A malicious guest can consume all available system resources and cause denial of service conditions.
Remediation
Install update from vendor's website.