« Volver al listado

CVE-2023-3494

Estado: ModificadaAlta (8.8)—

The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports. The interface lets the guest copy a string into a buffer resident in the bhyve process' memory. A bug in the state machine implementation can result in a buffer overflowing when copying this string. Malicious, privileged software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root, mitigated by the capabilities assigned through the Capsicum sandbox available to the bhyve process.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Freebsd — Freebsd

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-3494",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-3494",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-21T20:16:54.904181Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "secteam@freebsd.org",
      "affectedData": [
        {
          "vendor": "FreeBSD",
          "modules": [
            "bhyve"
          ],
          "product": "FreeBSD",
          "versions": [
            {
              "status": "affected",
              "version": "13.2-RELEASE",
              "lessThan": "13.2-RELEASE-p2",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "13.1-RELEASE",
              "lessThan": "13.1-RELEASE-p9",
              "versionType": "release"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-08-01T23:15:31.053",
  "references": [
    {
      "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:07.bhyve.asc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secteam@freebsd.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20230831-0006/",
      "source": "secteam@freebsd.org"
    },
    {
      "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:07.bhyve.asc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20230831-0006/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secteam@freebsd.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports.  The interface lets the guest copy a string into a buffer resident in the bhyve process' memory.  A bug in the state machine implementation can result in a buffer overflowing when copying this string. Malicious, privileged software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root, mitigated by the capabilities assigned through the Capsicum sandbox available to the bhyve process."
    },
    {
      "lang": "es",
      "value": "El controlador fwctl implementa una máquina de estados que se ejecuta cuando un huésped bhyve accede a ciertos puertos de E/S x86.  La interfaz permite al huésped copiar una cadena en un búfer residente en la memoria del proceso bhyve.  Un error en la implementación de la máquina de estado puede provocar el desbordamiento del búfer al copiar esta cadena. El software malicioso y privilegiado que se ejecuta en una máquina virtual huésped puede explotar el desbordamiento del búfer para lograr la ejecución de código en el host en el proceso de espacio de usuario bhyve, que normalmente se ejecuta como root, mitigado por las capacidades asignadas a través de la caja de arena Capsicum disponible para el proceso bhyve."
    }
  ],
  "lastModified": "2026-06-17T06:14:12.840",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEEE6D52-27E4-438D-AE8D-7141320B5973"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:b1-p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66364EA4-83B1-4597-8C18-D5633B361A9C"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:b2-p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF9292DD-EFB1-4B50-A941-7485D901489F"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFB18F55-4F5C-4166-9A7E-6F6617179A90"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66E1C269-841F-489A-9A0A-5D145B417E0A"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECF1B567-F764-45F5-A793-BEA93720F952"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAFE3F33-2C57-4B52-B658-82572607BD8C"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C925DF75-2785-44BD-91CA-66D29C296689"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCE2DAEC-81A5-49E9-B7E7-4F143FA6B3F7"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7725D503-1437-4F90-B30C-007193D5F0E1"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49CDE3D8-2924-42B9-8778-C5A517F5451E"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:rc1-p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B536EE52-ED49-4A85-BC9D-A27828D5A961"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A87EFA20-DD6B-41C5-98FD-A29F67D2E732"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2888B0C1-4D85-42EC-9696-03FAD0A9C28F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secteam@freebsd.org"
}