Published: 14/03/2020 Updated: 21/07/2021

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part of a memrw command (read_* or write_*) by a guest through a grub2.cfg file. This allows an untrusted guest to perform arbitrary read or write operations in the context of the grub-bhyve process, resulting in code execution as root on the host OS.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freebsd freebsd

FreeBSD grub-bhyve bootloader virtual machine escapes – [CVE-2020-10565, CVE-2020-10566] Introduction FreeBSD bhyve does not have legacy BIOS emulation [1] to start a VM using the full boot process As an alternative to BIOS emulation, a userspace bootloader running as host process directly loads the kernel image into the guest memory, initializes the registers, sets up t

CWE-119 https://svnweb.freebsd.org/ports?view=revision&revision=525916 https://nvd.nist.gov https://github.com/renorobert/grub-bhyve-bugs

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2020-10565

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect