From 9829834214d7a8b7fe111e3b41245c5b206bce4f Mon Sep 17 00:00:00 2001 From: feld Date: Tue, 6 Dec 2016 20:03:52 +0000 Subject: Document FreeBSD-SA-16:38.bhyve Security: CVE-2016-1889 --- security/vuxml/vuln.xml | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) (limited to 'security/vuxml') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index e41addc4e20..04cab6d568f 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,42 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + FreeBSD -- bhyve(8) virtual machine escape + + + FreeBSD + 11.011.0_4 + 10.310.3_13 + 10.210.2_26 + 10.110.1_43 + + + + +

Problem Description:

The bounds checking of accesses to guest memory greater + than 4GB by device emulations is subject to integer + overflow.

Impact:

For a bhyve virtual machine with more than 3GB of guest + memory configured, a malicious guest could craft device + descriptors that could give it access to the heap of the + bhyve process. Since the bhyve process is running as root, + this may allow guests to obtain full control of the hosts + they're running on.

+ + + + CVE-2016-1889 + SA-16:38.bhyve + + + 2016-12-06 + 2016-12-06 + + + FreeBSD -- link_ntoa(3) buffer overflow -- cgit