Arbitrary Write to Kernel Help Memory in Bhyve

CVE-2024-42416

What is CVE-2024-42416?

The ctl_report_supported_opcodes function in FreeBSD's bhyve fails to adequately validate input from userspace, allowing an arbitrary write to kernel help memory. This vulnerability can be exploited by malicious software running in a guest VM that presents virtio_scsi, potentially leading to code execution on the host machine within the bhyve userspace process, which typically operates with root privileges. Although bhyve is executed in a Capsicum sandbox that limits the capabilities of the running processes, the risk of remote code execution posed by a malicious iSCSI initiator on the iSCSI target host remains significant, necessitating prompt attention to secure systems running affected versions.

References