CVE-2022-23087 Bhyve e82545 device emulation out-of-bounds write
A guest VM can trigger an out-of-bounds write in the bhyve e1000 emulation, potentially allowing host code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23087?
CVE-2022-23087 is a high-severity memory corruption vulnerability in Freebsd Freebsd, published on 15 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload ("TSO"). The e1000 device model uses an on-stack buffer to generate the modified packet header when simulating these modifications on transmitted packets.
When checksum offload is requested for a transmitted packet, the e1000 device model used a guest-provided value to specify the checksum offset in the on-stack buffer. The offset was not validated for certain packet types.
A misbehaving bhyve guest could overwrite memory in the bhyve process on the host, possibly leading to code execution in the host context.
The bhyve process runs in a Capsicum sandbox, which (depending on the FreeBSD version and bhyve configuration) limits the impact of exploiting this issue.
Weakness: CWE-787
Which versions are affected by CVE-2022-23087?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2022-23087?
No fix has been published for CVE-2022-23087 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-23087 being exploited?
There is no known exploitation of CVE-2022-23087 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-rmqc-8468-5wx2.