CVE-2024-25940 bhyveload(8) host file access
A malicious guest script can read arbitrary host files accessible to the bhyveload user, potentially exposing sensitive data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-25940?
CVE-2024-25940 is a medium-severity path traversal vulnerability in Freebsd Freebsd, published on 15 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
`bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any attempt to restrict loader's access to <host-path>, allowing the loader to read any file the host user has access to. In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image. A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root.
Weakness: CWE-922
Which versions are affected by CVE-2024-25940?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2024-25940?
No fix has been published for CVE-2024-25940 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-25940 being exploited?
There is no known exploitation of CVE-2024-25940 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-j347-m6ww-35jg.