CVE-2024-32668

Estado: ModificadaAlta (8.2)—
An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller.
A malicious, privileged software running in a guest VM can exploit the vulnerability to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process.
CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 8.2
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.21%
Percentil entre todas las CVEs puntuadas: 11
Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)

Freebsd — Freebsd
CWE

CWE-193, CWE-787
CWE-787
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32668",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32668",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-05T13:09:07.350550Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      }
    ]
  },
  "affected": [
    {
      "source": "secteam@freebsd.org",
      "affectedData": [
        {
          "vendor": "FreeBSD",
          "modules": [
            "bhyve"
          ],
          "product": "FreeBSD",
          "versions": [
            {
              "status": "affected",
              "version": "14.1-RELEASE",
              "lessThan": "p4",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "14.0-RELEASE",
              "lessThan": "p10",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "13.3-RELEASE",
              "lessThan": "p6",
              "versionType": "release"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*"
          ],
          "vendor": "freebsd",
          "product": "freebsd",
          "versions": [
            {
              "status": "affected",
              "version": "14.1",
              "lessThan": "14.1_p4",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "14.0",
              "lessThan": "14.0_p10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "13.3",
              "lessThan": "13.3_p6",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-05T05:15:13.433",
  "references": [
    {
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:12.bhyve.asc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secteam@freebsd.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20240920-0007/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secteam@freebsd.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-193"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller.\n\nA malicious, privileged software running in a guest VM can exploit the vulnerability to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process."
    },
    {
      "lang": "es",
      "value": "Una validación de los límites insuficiente en el código USB podría provocar una escritura fuera de los límites en el montón, con datos controlados por el autor de la llamada. Un software malicioso y privilegiado que se ejecute en una máquina virtual invitada puede aprovechar la vulnerabilidad para lograr la ejecución de código en el host en el proceso de espacio de usuario bhyve, que normalmente se ejecuta como raíz. Tenga en cuenta que bhyve se ejecuta en un entorno aislado de Capsicum, por lo que el código malicioso está limitado por las capacidades disponibles para el proceso bhyve."
    }
  ],
  "lastModified": "2026-06-17T07:30:11.590",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E82CE719-C11D-4C34-BDF9-5AA704884289",
              "versionEndExcluding": "13.3",
              "versionStartIncluding": "13.0"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17DAE911-21E1-4182-85A0-B9F0059DDA7F"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABEA48EC-24EA-4106-9465-CE66B938635F"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DFB5BD0-E777-4CAA-B2E0-3F3357D06D01"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC8C769C-A23E-4F61-AC42-4DA64421B096"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45B0589E-2E7D-4516-A8A0-88F30038EAB0"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5CD8EF6-B119-488F-A278-8E9740E3E482"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.4:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F52349C-6051-4CB9-8659-763A22C31640"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA25530A-133C-4D7C-8993-D5C42D79A0B5"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB7B021E-F4AD-44AC-96AB-8ACAF8AB1B88"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69A72B5A-2189-4700-8E8B-1E5E7CA86C40"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5771F187-281B-4680-B562-EFC7441A8F88"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A4437F5-9DDA-4769-974E-23BFA085E0DB"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9C3A3D4-C9F4-41EB-B532-821AF83470B1"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "878A1F0A-087F-47D7-9CA5-A54BB8D6676A"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE73CDC3-B5A7-4921-89C6-8F9DC426CB3E"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50A5E650-31FB-45BE-8827-641B58A83E45"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D59CFDD3-AEC3-43F1-A620-0B1F0BAD9048"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44B8A489-6314-460D-90DA-AFB54298C8E6"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "038E5B85-7F60-4D71-8D3F-EDBF6E036CE0"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF309824-D379-4749-A1FA-BCB2987DD671"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79D770C6-7A57-4A49-8164-C55391F62301"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA813990-8C8F-4EE8-9F2B-9F73C510A7B2"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4DFA201-27D5-4C01-B90F-E24778943C3B"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01DD321B-E5E2-49F7-86A1-D40B13E257C7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secteam@freebsd.org"
}