From nobody Thu Sep 05 06:55:13 2024 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Wzqqj2w3Hz5VPhc; Thu, 05 Sep 2024 06:55:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Wzqqj2Jjhz4R1H; Thu, 5 Sep 2024 06:55:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725519313; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YOB71Mmx6ihew/Ca4UKadxDEbFccpjb5/CmHdiMSOeE=; b=SdIcuNgK+PeDU9R90Oh2FOy3/XFnWpitWCXnsMc63h+WxXE0jxnGrt3oirI2LbQSgcvnwr ws2ULovmAlNjuT9mNC2+HigBhkRuDiey0A7FTLTKDnzbkN6WTPElsWtEg5O71byphttWGf 8gWKmjGz6Cvxs2vACgxfHOHFYc8NkhfSJWGA6T1Dg2eqXRx1YShKnk83DX0WsIt92tOpMS Pv5FvjCg2OgengbaEdseSsD1o8K3qQ8Z1cxzJS9ga0winfjk1orfz2Aq9t9oR5d+8DDi+D HYurtjkRp2KfLthjjjn4UKNdF2tZFS1EqI6BQXIqKwDwMBCGj3SDdmNH1tKFFw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1725519313; a=rsa-sha256; cv=none; b=GkTpil2WVCtDkeYIvsXmJ40kPtkrWOn3JDxA982OsGwE120MX9Qx+dUI4UiOD7glsfSzqx mzr91QH8jIjhhBS0V7bpqPRSWIMsdvTghu3SM9YtWKO5JWJHNmMDZa6ori1QKs0yuA8W7N kWL2THRINh4ioW18AJDxTN9mi+Gw7H+Jn7wcobWPMEcZwLMO/l7ScctFZd9RxnY8zkgF9m Hz03kQyCJIMHA8KNkDCI7ydWjVwX42Ow1gHmIfqF9a0z4AQRpJ52wlTnV10uZk3CKbn4GX 00eYCSY0EQoZTm0N5vzOoyTrYbbSr0fiTv340x0CCwBATUka4zEgo+8dhQ9ZBQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725519313; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YOB71Mmx6ihew/Ca4UKadxDEbFccpjb5/CmHdiMSOeE=; b=pawI4bLi1VPA9vcuBD3uVTM4aEVpdLODKOXOjGJUeMgzd/taARETh9fm3TfYrnL1uEdiWp IQQQeHs5PtthXKJYuDlOD3aBp8Hc9FmXW4uz0rd7yldngu8WJ6+/CdomhQTxIZCZzsPTxG hXOb9YcpnVg6JiISelkDImW9NOK6kYJuY6ni7KqWY6WUBN0vPAZx84IWPpi3HdHfwIlmg6 fOJvUny9qPLYVgwzkWFqSRGaWk0eLw5XH9Ei1vcbJ0se6y6V5XLZPh8jIjjP2owd61YcE3 9bRqu7tb3HZTQaxcVzmdQAZ8xuT33dMorGc10Khe1mpYpCR9nTKLUdyHnETuIA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Wzqqj1w50zyTM; Thu, 5 Sep 2024 06:55:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4856tDnf068642; Thu, 5 Sep 2024 06:55:13 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4856tD4h068639; Thu, 5 Sep 2024 06:55:13 GMT (envelope-from git) Date: Thu, 5 Sep 2024 06:55:13 GMT Message-Id: <202409050655.4856tD4h068639@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Philip Paeps Subject: git: b73693f0eedf - main - security/vuxml: add FreeBSD SAs issued 2024-09-04 List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: philip X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b73693f0eedf7faa865abe0d90ac00281ec90d19 Auto-Submitted: auto-generated The branch main has been updated by philip: URL: https://cgit.FreeBSD.org/ports/commit/?id=b73693f0eedf7faa865abe0d90ac00281ec90d19 commit b73693f0eedf7faa865abe0d90ac00281ec90d19 Author: Philip Paeps AuthorDate: 2024-09-05 06:39:26 +0000 Commit: Philip Paeps CommitDate: 2024-09-05 06:54:04 +0000 security/vuxml: add FreeBSD SAs issued 2024-09-04 FreeBSD-SA-24:09.libnv affects all supported releases FreeBSD-SA-24:10.bhyve affects FreeBSD 14.x FreeBSD-SA-24:11.ctl affects all supported releases FreeBSD-SA-24:12.bhyve affects all supported releases FreeBSD-SA-24:14.umtx affects all supported releases --- security/vuxml/vuln/2024.xml | 204 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 204 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 84734eddc024..ed0f4fa2025f 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,207 @@ + + FreeBSD -- umtx Kernel panic or Use-After-Free + + + FreeBSD + 14.114.1_4 + 14.014.0_10 + 13.313.3_6 + + + + +

Problem Description:

+

Concurrent removals of such a mapping by using the UMTX_SHM_DESTROY + sub-request of UMTX_OP_SHM can lead to decreasing the reference + count of the object representing the mapping too many times, causing + it to be freed too early.

+

Impact:

+

A malicious code exercizing the UMTX_SHM_DESTROY sub-request + in parallel can panic the kernel or enable further Use-After-Free + attacks, potentially including code execution or Capsicum sandbox + escape.

+ + + + CVE-2024-43102 + SA-24:14.umtx + + + 2024-09-04 + 2024-09-05 + + + + + FreeBSD -- bhyve(8) privileged guest escape via USB controller + + + FreeBSD + 14.114.1_4 + 14.014.0_10 + 13.313.3_6 + + + + +

Problem Description:

+

bhyve can be configured to emulate devices on a virtual USB + controller (XHCI), such as USB tablet devices. An insufficient + boundary validation in the USB code could lead to an out-of-bounds + write on the heap, with data controlled by the caller.

+

Impact:

+

A malicious, privileged software running in a guest VM can + exploit the vulnerability to achieve code execution on the host in + the bhyve userspace process, which typically runs as root. Note + that bhyve runs in a Capsicum sandbox, so malicious code is constrained + by the capabilities available to the bhyve process.

+ + + + CVE-2024-32668 + SA-24:12.bhyve + + + 2024-09-04 + 2024-09-05 + + + + + FreeBSD -- Multiple issues in ctl(4) CAM Target Layer + + + FreeBSD-kernel + 14.114.1_4 + 14.014.0_10 + 13.313.3_6 + + + + +

Problem Description:

+

Several vulnerabilities were found in the ctl subsystem.

+

The function ctl_write_buffer incorrectly set a flag which resulted + in a kernel Use-After-Free when a command finished processing + (CVE-2024-45063). The ctl_write_buffer and ctl_read_buffer functions + allocated memory to be returned to userspace, without initializing + it (CVE-2024-8178). The ctl_report_supported_opcodes function did + not sufficiently validate a field provided by userspace, allowing + an arbitrary write to a limited amount of kernel help memory + (CVE-2024-42416). The ctl_request_sense function could expose up + to three bytes of the kernel heap to userspace (CVE-2024-43110).

+

Guest virtual machines in the bhyve hypervisor can send SCSI commands + to the corresponding kernel driver via the virtio_scsi interface. + This provides guests with direct access to the vulnerabilities + covered by this advisory.

+

The CAM Target Layer iSCSI target daemon ctld(8) accepts incoming + iSCSI connections, performs authentication and passes connections + to the kernel ctl(4) target layer.

+

Impact:

+

Malicious software running in a guest VM that exposes virtio_scsi + can exploit the vulnerabilities to achieve code execution on the + host in the bhyve userspace process, which typically runs as root. + Note that bhyve runs in a Capsicum sandbox, so malicious code is + constrained by the capabilities available to the bhyve process.

+

A malicious iSCSI initiator could achieve remote code execution on + the iSCSI target host.

+ + + + CVE-2024-8178 + CVE-2024-42416 + CVE-2024-43110, + SA-24:11.ctl + + + 2024-09-04 + 2024-09-05 + + + + + FreeBSD -- bhyve(8) privileged guest escape via TPM device passthrough + + + FreeBSD + 14.114.1_4 + 14.014.0_10 + + + + +

Problem Description:

+

bhyve can be configured to provide access to the host's TPM + device, where it passes the communication through an emulated device + provided to the guest. This may be performed on the command-line + by starting bhyve with the `-l tpm,passthru,/dev/tpmX` parameters.

+

The MMIO handler for the emulated device did not validate the offset + and size of the memory access correctly, allowing guests to read + and write memory contents outside of the memory area effectively + allocated.

+

Impact:

+

Malicious software running in a guest VM can exploit the buffer + overflow to achieve code execution on the host in the bhyve userspace + process, which typically runs as root. Note that bhyve runs in a + Capsicum sandbox, so malicious code is constrained by the capabilities + available to the bhyve process.

+ + + + CVE-2024-41928 + SA-24:10.bhyve + + + 2024-09-04 + 2024-09-05 + + + + + FreeBSD -- Multiple vulnerabilities in libnv + + + FreeBSD-kernel + 14.114.1_4 + 14.014.0_10 + 13.313.3_6 + + + FreeBSD + 14.114.1_4 + 14.014.0_10 + 13.313.3_6 + + + + +

Problem Description:

+

CVE-2024-45287 is a vulnerability that affects both the kernel + and userland. A malicious value of size in a structure of packed + libnv can cause an integer overflow, leading to the allocation of + a smaller buffer than required for the parsed data.

+

CVE-2024-45288 is a vulnerability that affects both the kernel and + userland. A missing null-termination character in the last element + of an nvlist array string can lead to writing outside the allocated + buffer.

+

Impact:

+

It is possible for an attacker to overwrite portions of memory + (in userland or the kernel) as the allocated buffer might be smaller + than the data received from a malicious process. This vulnerability + could result in privilege escalation or cause a system panic.

+ + + + CVE-2024-45287 + CVE-2024-45288 + SA-24:09.libnv + + + 2024-09-04 + 2024-09-05 + + + OpenSSL -- Multiple vulnerabilities