Threats affecting pkg:deb/freebsd/freebsd

CVE-2024-45063 is a critical Use-After-Free vulnerability in FreeBSD affecting versions 13.3-RELEASE, 14.0-RELEASE, and 14.1-RELEASE. It arises from incorrect flag handling in the ctl_write_buffer function, leading to kernel memory corruption. Exploitation can occur via malicious software running in a guest VM exposing virtio_scsi, potentially allowing code execution on the host's bhyve userspace process, which runs with root privileges but within a Capsicum sandbox. Additionally, a malicious iSCSI initiator could achieve remote code execution on the iSCSI target host. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity.

CVE-2024-43110 is an out-of-bounds read vulnerability in FreeBSD's ctl_request_sense function that can expose kernel heap bytes to userspace. It affects FreeBSD versions 13.3-RELEASE, 14.0-RELEASE, and 14.1-RELEASE. Malicious software running in a guest VM with virtio_scsi can exploit this to execute code on the host's bhyve userspace process, which runs with root privileges but within a Capsicum sandbox. Additionally, a malicious iSCSI initiator could achieve remote code execution on the iSCSI target host. The vulnerability has a high severity with a CVSS score of 8.4.

CVE-2024-42416 is a high severity vulnerability in FreeBSD affecting versions 13.3-RELEASE, 14.0-RELEASE, and 14.1-RELEASE. It involves insufficient validation in the ctl_report_supported_opcodes function, allowing an arbitrary write to kernel heap memory. This flaw can be exploited by malicious software running in a guest VM exposing virtio_scsi to achieve code execution in the bhyve userspace process, which runs with root privileges but within a Capsicum sandbox. Additionally, a malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.

CVE-2024-8178 is a critical vulnerability in FreeBSD where the ctl_write_buffer and ctl_read_buffer functions allocate memory without initializing it. This flaw can be exploited by malicious software running in a guest VM exposing virtio_scsi to execute code on the host's bhyve userspace process, which runs with root privileges but within a Capsicum sandbox. Additionally, a malicious iSCSI initiator could achieve remote code execution on the iSCSI target host. The vulnerability affects FreeBSD versions 13.3-RELEASE, 14.0-RELEASE, and 14.1-RELEASE.