Buffer Overflow Vulnerability in e1000 Network Adapters Could Lead to Code Execution

CVE-2022-23087

What is CVE-2022-23087?

The e1000 network adapters are designed to allow various modifications to Ethernet packets during transmission, including the ability to insert IP and TCP checksums, Ethernet VLAN headers, and utilize TCP segmentation offload (TSO). However, a flaw exists where the e1000 device model employs an on-stack buffer to craft modified packet headers based on a guest-provided checksum offset, which is not validated for specific packet types. This oversight enables a misbehaving bhyve guest to potentially overwrite memory within the bhyve process running on the host system. Although the bhyve process operates within a Capsicum sandbox that may constrain the scope of exploitation depending on the FreeBSD version and configuration, it raises significant concerns regarding host security and integrity.

References