Published: 25/09/2020 Updated: 01/01/2022

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 8.2 | Impact Score: 6 | Exploitability Score: 1.5

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

bhyve, as used in FreeBSD up to and including 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying VMCS_HOST_RIP.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freebsd freebsd
freebsd freebsd 11.3
freebsd freebsd 11.4
freebsd freebsd 12.0
freebsd freebsd 12.1
omniosce omnios
openindiana openindiana
netapp clustered data ontap -

CWE-862 https://github.com/illumos/illumos-gate/blob/84971882a96ac0fecd538b02208054a872ff8af3/usr/src/uts/i86pc/io/vmm/intel/vmcs.c#L246-L249 https://security.FreeBSD.org/advisories/FreeBSD-SA-20:28.bhyve_vmcs.asc https://security.netapp.com/advisory/ntap-20201016-0002/https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2020-24718

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect