FreeBSD Security Advisory FreeBSD-SA-24:12.bhyve

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-SA-24:12.bhyve                                      Security Advisory
                                                          The FreeBSD Project

Topic:          bhyve(8) privileged guest escape via USB controller

Category:       core
Module:         bhyve
Announced:      2024-09-04
Credits:        Synacktiv
Sponsored by:   The FreeBSD Foundation, The Alpha-Omega Project
Affects:        All supported versions of FreeBSD.
Corrected:      2024-09-04 15:42:30 UTC (stable/14, 14.1-STABLE)
                2024-09-04 21:07:34 UTC (releng/14.1, 14.1-RELEASE-p4)
                2024-09-04 20:54:19 UTC (releng/14.0, 14.0-RELEASE-p10)
                2024-09-04 15:45:38 UTC (stable/13, 13.4-STABLE)
                2024-09-04 19:58:26 UTC (releng/13.4, 13.4-RC2-p1)
                2024-09-04 20:29:46 UTC (releng/13.3, 13.3-RELEASE-p6)
CVE Name:       CVE-2024-32668

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.

I.   Background

bhyve(8) is a hypervisor that runs guest operating systems inside a virtual
machine.

II.  Problem Description

bhyve can be configured to emulate devices on a virtual USB controller (XHCI),
such as USB tablet devices. An insufficient boundary validation in the USB code
could lead to an out-of-bounds write on the heap, with data controlled by the
caller.

III. Impact

A malicious, privileged software running in a guest VM can exploit the
vulnerability to achieve code execution on the host in the bhyve userspace
process, which typically runs as root. Note that bhyve runs in a Capsicum
sandbox, so malicious code is constrained by the capabilities available to the
bhyve process.

IV.  Workaround

No workaround is available, but VMs that do not make the XHCI device
available to the guest (via `bhyve -s xhci,...`) are not impacted.

V.   Solution

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.

Guest operating systems emulating USB devices with XHCI need to be restarted for
the correction to be applied. (i.e., their corresponding bhyve process needs to
be terminated and started again)

Perform one of the following:

1) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:

# freebsd-update fetch
# freebsd-update install

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/SA-24:12/bhyve.patch
# fetch https://security.FreeBSD.org/patches/SA-24:12/bhyve.patch.asc
# gpg --verify bhyve.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

Restart the corresponding bhyve processes, or reboot the system.

VI.  Correction details

This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:

Branch/path                             Hash                     Revision
- -------------------------------------------------------------------------
stable/14/                              90af1336ed5e    stable/14-n268657
releng/14.1/                            bb245c142075  releng/14.1-n267702
releng/14.0/                            1d01a6c11210  releng/14.0-n265439
stable/13/                              5920b7e6eea1    stable/13-n258311
releng/13.4/                            b3f0e555781c  releng/13.4-n258244
releng/13.3/                            5d6576f4f000  releng/13.3-n257454
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

The corresponding part of the security audit report as provided by Synacktiv
will be published in due course.

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32668>

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:12.bhyve.asc>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY544ACgkQbljekB8A
Gu+rCw/9FKPcF1L1kRh6J9Y6TLEmMIQx95YwodI4O11KMjgEL3wnz36p/Mrkrj8Z
g8h2+OBmqdr8NegyKHIuOHo8j9M892dnZpGWjyCgtbpnc57rXZhm83DDzRQ2r9OP
7yOWftWjgje1cyTphlFAr2p6IWg6z+6UicGwmeV17FSaG5rPjWuYoOOt63kzk3NA
0viDPIgLpoyGRCaiXa/sdoM2YQH9FxzKEC2yeURF/mLSPEFhaMO6SS8nrxmRC9Wc
f8DP5G00I3RPjAQ5ehXc5n0z88SHGKJc/dstI4jSzguyBNO8HQtCD6HC6uEo0ACV
EEJ80FJ+TOfZ9fhHkyEpGfMxwsAjpzud0zZWKV8+4jeY3kIp94g8MCKrHkLr6hXL
0+DMBsdqNS3T7lPzIimhJ7cwk/fXVQvUWu3rGBO33l3IUK0BWz/o3cTARTPEl/Zi
MMBETwn+ga6JioRBTmmOMazufAyA3Nlf/eRzIc9RGTUBjoqnY0jHzdwfPI8hDKXR
1bi1Rii8IcAmaHvMkGww6PJOkRTV8uyuW6JZ2te8V8PC5ojdUniYq5JN6mbrkpOR
RIYt3f16o6ANZ9qgMqmq2gdBBnJ80LDkQa71FV1bDf9g/LEd5aDynloaZb5D3EMp
0J0ZIPKKy/qprhVzEjxROzhLzNH0bJy6yaQhoxPY3QLzU78qrE4=
=nYwM
-----END PGP SIGNATURE-----