Threats tagged 'ghsa-hgfp-qxpq-6q7w'

The ctl_report_supported_opcodes function in bhyve userspace does not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel heap memory. This vulnerability can be exploited by malicious software running in a guest VM exposing virtio_scsi to achieve code execution on the host within the bhyve userspace process, which typically runs as root. The bhyve process runs in a Capsicum sandbox, limiting the capabilities of malicious code. Additionally, a malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.