Summary
Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen preiszugeben und die Authentifizierung zu umgehen.
Product
FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und gehört damit zu den Unix Derivaten.
Vulnerabilities 6
-
High 7.5
Unbounded allocation in ctl(4) CAM Target Layer
The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring the option. Fetch wou…
-
High 7.5
bhyve(8) infinite loop in the hda audio driver
A guest can trigger an infinite loop in the hda audio driver.
-
Medium 6.5
bhyve(8) nvme_opc_get_log_page buffer over-read
The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value.
-
Medium 6.5
bhyve(8) virtio_vq_recordon time-of-check to time-of-use race
The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition.
-
Medium 6.5
bhyve(8) hda driver buffer over-read
The hda driver is vulnerable to a buffer over-read from a guest-controlled value.
-
Medium 5.3
Unbounded allocation in ctl(4) CAM Target Layer
The command ctl_persistent_reserve_out allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator.
Revision history
-
#1
Initiale Fassung
References
-
FreeBSD Security Advisory vom 2024-10-29
https://security.FreeBSD.org/advisories/FreeBSD-SA-24:17.bhyve.asc
-
FreeBSD Security Advisory vom 2024-10-29
https://security.FreeBSD.org/advisories/FreeBSD-SA-24:18.ctl.asc
-
FreeBSD Security Advisory vom 2024-10-29
https://security.FreeBSD.org/advisories/FreeBSD-SA-24:19.fetch.asc