Description (CNA)
The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory. The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process. This could potentially lead to user-mode code execution on the host, subject to bhyve's Capsicum sandbox.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| FreeBSD / FreeBSD | affected 13.1-RELEASE before p1; affected 13.0-RELEASE before p12 |
CWE
No CWE identifiers supplied.
References
- https://security.freebsd.org/advisories/FreeBSD-SA-22:12.lib9p.asc
- https://security.netapp.com/advisory/ntap-20240415-0009/
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.