CVE-2024-25940
Estado: AnalizadaMedia (6.3)—
`bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any attempt to restrict loader's access to <host-path>, allowing the loader to read any file the host user has access to. In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image. A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Puntuación base: 6.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.51%
- Percentil entre todas las CVEs puntuadas: 41
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-922
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-25940",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-25940",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-02-21T20:43:31.439077Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 3.4,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "secteam@freebsd.org",
"affectedData": [
{
"vendor": "FreeBSD",
"modules": [
"bhyveload"
],
"product": "FreeBSD",
"versions": [
{
"status": "affected",
"version": "14.0-RELEASE",
"lessThan": "p5",
"versionType": "release"
},
{
"status": "affected",
"version": "13.2-RELEASE",
"lessThan": "p10",
"versionType": "release"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-02-15T05:15:11.100",
"references": [
{
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:01.bhyveload.asc",
"tags": [
"Vendor Advisory"
],
"source": "secteam@freebsd.org"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240419-0004/",
"tags": [
"Third Party Advisory"
],
"source": "secteam@freebsd.org"
},
{
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:01.bhyveload.asc",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240419-0004/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-922"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "`bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any attempt to restrict loader's access to <host-path>, allowing the loader to read any file the host user has access to. In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image. A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root."
},
{
"lang": "es",
"value": "`bhyveload -h ` se puede usar para otorgar acceso al cargador al árbol de directorios en el host. Las versiones afectadas de bhyveload(8) no intentan restringir el acceso del cargador a , lo que le permite leer cualquier archivo al que el usuario host tenga acceso. En el modelo bhyveload(8), el host proporciona un userboot.so para arrancar, pero los scripts del cargador generalmente provienen de la imagen del invitado. Se podría utilizar un script creado con fines malintencionados para extraer datos confidenciales del host al que puede acceder el usuario que ejecuta bhyhveload(8), que suele ser la raíz del sistema."
}
],
"lastModified": "2026-06-17T07:16:45.890",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69125938-D4B2-43D0-AA23-1CCCEB114936",
"versionEndExcluding": "13.2"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49A95FB1-562D-4804-ACB6-73193028DAE7",
"versionEndExcluding": "14.0",
"versionStartIncluding": "13.3"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2888B0C1-4D85-42EC-9696-03FAD0A9C28F"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3306F11-D3C0-41D6-BB5E-2ABDC3927715"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E584FE1-3A34-492B-B10F-508DA7CBA768"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5605E90-D125-4CC9-8B9F-F5EED9D4EE0C"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "761B4382-E857-4868-9F80-189B7F60256B"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51B17801-15FD-4425-BA6C-BE06B14F1BFE"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9CAFF74-AD36-4D29-83F3-23E0417C485D"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1B2D2A82-BFFE-45FE-9F79-4AF12C6DE69D"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7A81663-047E-4328-BE3A-CF65AB55B29F"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB7B021E-F4AD-44AC-96AB-8ACAF8AB1B88"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69A72B5A-2189-4700-8E8B-1E5E7CA86C40"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5771F187-281B-4680-B562-EFC7441A8F88"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A4437F5-9DDA-4769-974E-23BFA085E0DB"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9C3A3D4-C9F4-41EB-B532-821AF83470B1"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "038E5B85-7F60-4D71-8D3F-EDBF6E036CE0"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF309824-D379-4749-A1FA-BCB2987DD671"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secteam@freebsd.org"
}