From nobody Fri Sep 20 06:19:45 2024 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4X92Kt2bQvz5Wbpf; Fri, 20 Sep 2024 06:19:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4X92Kt0SlDz4mn5; Fri, 20 Sep 2024 06:19:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1726813186; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QnNPEZ8HJYWcLOoG+WJRC2ZRI1MXBtUwmhhoGQG8Aqc=; b=gMq7CDgblaPnuDQ1sKIXIpNLOlg/Tx4zfqVbVxtZG05AsSjzgta+bW+6XXJ1q4Wr/8tb1g X2Uj/EADoOxqsfe/65xq3Fo7t61lXQN7qP8YbuDnycsL1dPWgOLqcTxH3LOTrQEbUnArq6 PsqrZqwJTD2PpT4n8GkfpZk9PX3GujpOY0TtUt1jzaIKHCq9hUj4Tqr+38LzAoj/9/Dih+ 8WHDPG9kxuT+wwGqKkKGjbGvTFg91TR+P3/nOmTbn+V+R5KOowKkcHmucZfswfBGyqctO7 38XiMfhyvQ99GeSOkmxF1c46QVsZLwtVtu3shAARuAjHEPWO/TYKDIYZ9ON19g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1726813186; a=rsa-sha256; cv=none; b=PtncdHGd2c8S+/iBr9bj2v+e9eVntB1L4R5S5jifMHtVcI9b+FhteHsfY6s+N7junQAXKa nqYhuouyDWK5iFWEtcqu00Q6D/6bU0AfWF9O9rVLF7em206WbQJdwwpzpShoeQ8DsT60li rES+BSLxwYh4VRbjPOO6UPKTFwTx/B8EMSL9RFOrRsrFBOqGbyWE6n/EzVgeXtG2IN6lfI vMk5xacBufcyyAV2mET/yn8/5GcY48x991aQwgyfaVaJJMLS625oU+SQUTxaB3I9cONDBz yzjYbYi4aQs+tO5kPm7E+b6r11KJlLq55pxSTVmgS+FxOBzgyCgtkqiYt2uhZg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1726813186; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QnNPEZ8HJYWcLOoG+WJRC2ZRI1MXBtUwmhhoGQG8Aqc=; b=A0jUx0Xjb2SB6qdsAg3Rg/LU/YhlBxsjZNIVzeUwRU0m5hqXzRZ0EKx0LsP67OLf/zsBUv SVOnv+powp1KKZBSGEPYb9V6okSZINwzQAh0mMdRwhRti1nBRh3IwNpvNSNlnimqRIZsD+ xKUEDvDrcGvya292s7OzZQ2zhDwjlkfb108MK1WeXE7lRt3vuhVFsuv3p/uRYlXHZ33l6l 19y2aCWIaZZCYnZQ8bLT2ZgnP88v9NY7g79yGwGQXhnLiGoGRuOBED+Gw7LCbG3uMHMthY vLBFFYHMv4llCQ6/xPpJMn65Xw+XYvmeIWbIMn+gY5dKPqE4DsBZoE0KN4DFsQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4X92Ks74V8zdSk; Fri, 20 Sep 2024 06:19:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 48K6JjEV059272; Fri, 20 Sep 2024 06:19:45 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 48K6Jjf0059269; Fri, 20 Sep 2024 06:19:45 GMT (envelope-from git) Date: Fri, 20 Sep 2024 06:19:45 GMT Message-Id: <202409200619.48K6Jjf0059269@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Philip Paeps Subject: git: b32b229ab83e - main - security/vuxml: add FreeBSD SAs issued on 2024-09-19 List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-main@freebsd.org Sender: owner-dev-commits-ports-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: philip X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b32b229ab83e79939d076c117b057270da7061d3 Auto-Submitted: auto-generated The branch main has been updated by philip: URL: https://cgit.FreeBSD.org/ports/commit/?id=b32b229ab83e79939d076c117b057270da7061d3 commit b32b229ab83e79939d076c117b057270da7061d3 Author: Philip Paeps AuthorDate: 2024-09-20 06:13:37 +0000 Commit: Philip Paeps CommitDate: 2024-09-20 06:13:37 +0000 security/vuxml: add FreeBSD SAs issued on 2024-09-19 FreeBSD-SA-24:15.bhyve affects all supported versions of FreeBSD FreeBSD-SA-24:16.libnv affects all supported versions of FreeBSD --- security/vuxml/vuln/2024.xml | 84 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 84 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index fa69689bed0f..e770bbdf338e 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,87 @@ + + FreeBSD -- Integer overflow in libnv + + + FreeBSD-kernel + 14.114.1_5 + 14.014.0_11 + 13.413.4_1 + 13.313.3_7 + + + FreeBSD + 14.114.1_5 + 14.014.0_11 + 13.413.4_1 + 13.313.3_7 + + + + +

Problem Description:

+

A malicious value of size in a structure of packed libnv can + cause an integer overflow, leading to the allocation of a smaller + buffer than required for the parsed data. The introduced check was + incorrect, as it took into account the size of the pointer, not the + structure. This vulnerability affects both kernel and userland.

+

This issue was originally intended to be addressed as part of + FreeBSD-SA-24:09.libnv, but due to a logic issue, this issue was + not properly addressed.

+

Impact:

+

It is possible for an attacker to overwrite portions of memory + (in userland or the kernel) as the allocated buffer might be smaller + than the data received from a malicious process. This vulnerability + could result in privilege escalation or cause a system panic.

+ + + + CVE-2024-45287 + SA-24:16.libnv + + + 2024-09-19 + 2024-09-20 + + + + + FreeBSD -- bhyve(8) out-of-bounds read access via XHCI emulation + + + FreeBSD + 14.114.1_5 + 14.014.0_11 + 13.413.4_1 + 13.313.3_7 + + + + +

Problem Description:

+

bhyve can be configured to emulate devices on a virtual USB + controller (XHCI), such as USB tablet devices. An insufficient + boundary validation in the USB code could lead to an out-of-bounds read + on the heap, which could potentially lead to an arbitrary write and + remote code execution.

+

Impact:

+

A malicious, privileged software running in a guest VM can exploit + the vulnerability to crash the hypervisor process or potentially achieve + code execution on the host in the bhyve userspace process, which + typically runs as root. Note that bhyve runs in a Capsicum sandbox, so + malicious code is constrained by the capabilities available to the bhyve + process.

+ + + + CVE-2024-41721 + SA-24:15.bhyve + + + 2024-09-19 + 2024-09-20 + + + Gitlab -- vulnerabilities