#VU78875 State Issues in FreeBSD - CVE-2023-3494

Vulnerability identifier: #VU78875

Vulnerability risk: Medium

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-3494

CWE-ID: CWE-371

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
FreeBSD
Operating systems & Components / Operating system

Vendor: FreeBSD Foundation

Description

The vulnerability allows an attacker to escalate privileges on the system.

The vulnerability exists due to an error in the state machine implementation within the bhyve fwctl driver, which is executed when a bhyve guest accesses certain x86 I/O ports. A malicious, privileged software running in a guest VM can exploit the state issue to trigger buffer overflow and achieve code execution on the host in the bhyve userspace process.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

FreeBSD: 13.1 - 13.2

---

External links
https://security.FreeBSD.org/advisories/FreeBSD-SA-23:07.bhyve.asc

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.