8.8

CVE-2022-23092

Missing bounds check in 9p message handling

The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents.  The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory.

The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process.  This could potentially lead to user-mode code execution on the host, subject to bhyve's Capsicum sandbox.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Freebsd ≫ Freebsd Version 13.0 Update beta1
Freebsd ≫ Freebsd Version 13.0 Update beta2
Freebsd ≫ Freebsd Version 13.0 Update beta3
Freebsd ≫ Freebsd Version 13.0 Update beta3-p1
Freebsd ≫ Freebsd Version 13.0 Update beta4
Freebsd ≫ Freebsd Version 13.0 Update p1
Freebsd ≫ Freebsd Version 13.0 Update p10
Freebsd ≫ Freebsd Version 13.0 Update p11
Freebsd ≫ Freebsd Version 13.0 Update p2
Freebsd ≫ Freebsd Version 13.0 Update p3
Freebsd ≫ Freebsd Version 13.0 Update p4
Freebsd ≫ Freebsd Version 13.0 Update p5
Freebsd ≫ Freebsd Version 13.0 Update p6
Freebsd ≫ Freebsd Version 13.0 Update p7
Freebsd ≫ Freebsd Version 13.0 Update p8
Freebsd ≫ Freebsd Version 13.0 Update p9
Freebsd ≫ Freebsd Version 13.0 Update rc1
Freebsd ≫ Freebsd Version 13.0 Update rc2
Freebsd ≫ Freebsd Version 13.0 Update rc3
Freebsd ≫ Freebsd Version 13.0 Update rc4
Freebsd ≫ Freebsd Version 13.0 Update rc5
Freebsd ≫ Freebsd Version 13.0 Update rc5-p1
Freebsd ≫ Freebsd Version 13.1 Update b1-p1
Freebsd ≫ Freebsd Version 13.1 Update b2-p2
Freebsd ≫ Freebsd Version 13.1 Update rc1-p1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.65% 0.464
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://security.freebsd.org/advisories/FreeBSD-SA-22:12.lib9p.asc
Vendor Advisory
https://security.netapp.com/advisory/ntap-20240415-0009/
Third Party Advisory