CVE-2022-23092

Опубликовано: 15 фев. 2024

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process. This could potentially lead to user-mode code execution on the host, subject to bhyve's Capsicum sandbox.

Ссылки

https://security.freebsd.org/advisories/FreeBSD-SA-22:12.lib9p.asc
Vendor Advisory
https://security.netapp.com/advisory/ntap-20240415-0009/
Third Party Advisory
https://security.freebsd.org/advisories/FreeBSD-SA-22:12.lib9p.asc
Vendor Advisory
https://security.netapp.com/advisory/ntap-20240415-0009/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:freebsd:freebsd:13.0:beta1:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:beta2:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:beta3:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:beta3-p1:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:beta4:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p1:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p10:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p11:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p2:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p3:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p4:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p5:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p6:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p7:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p8:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:p9:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:rc1:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:rc2:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:rc3:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:rc4:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:rc5:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.0:rc5-p1:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.1:b1-p1:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.1:b2-p2:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.1:rc1-p1:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.00397

Низкий

8.8 High

CVSS3

Дефекты

CWE-787

Связанные уязвимости

GHSA-gvf3-496w-8fm9

CVSS3: 8.8

github

почти 2 года назад

The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory. The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process. This could potentially lead to user-mode code execution on the host, subject to bhyve's Capsicum sandbox.

BDU:2022-05217

CVSS3: 9.9

fstec

больше 3 лет назад

Уязвимость библиотеки lib9p операционных систем FreeBSD, позволяющая нарушителю выполнить произвольный код