Summary
De FreeBSD community heeft meerdere kwetsbaarheden verholpen in bhyve Hypervisor
Details
Interpretaties
De kwetsbaarheden betreffen race conditions, onjuiste validatie en synchronisatieproblemen in verschillende device modellen binnen de bhyve hypervisor. Een kwaadwillende gast-virtuele machine kan deze fouten misbruiken om een denial of service te veroorzaken door het bhyve proces te laten crashen of om arbitraire code uit te voeren in de host userspace. Dit kan plaatsvinden via manipulatie van event ring size en Transfer Request Block (TRB) velden in de USB 3 device model, het triggeren van out-of-bounds geheugen toegang door onjuiste controle van zero-length Buffer Descriptor List entries in de HDA audio device model, en door het misbruiken van duplicaten, unsynchronized constanten en ontbrekende validatie van resolutieparameters in de framebuffer device model. Deze kwetsbaarheden zijn specifiek voor systemen die de bhyve hypervisor gebruiken.
Oplossingen
FreeBSD heeft updates uitgebracht om deze kwetsbaarheden in de bhyve hypervisor te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 5
-
High 7.0
Multiple vulnerabilities in bhyve device models
The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the…
-
High 7.0
Multiple vulnerabilities in bhyve device models
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the…
-
High 7.0
Multiple vulnerabilities in bhyve device models
The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the…
-
Medium 5.9
Remotely triggerable buffer overflow in tcp_rack
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffe…
-
Medium 5.5
TOCTOU race between sound(4) buffer resizing and mmap
When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the re…
Revision history
-
#1.0.0
Initiele versie