The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it.
Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.
The product does not initialize a critical resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Freebsd | Freebsd | 13.0 (including) | 13.3 (excluding) |
| Freebsd | Freebsd | 13.3 (including) | 13.3 (including) |
| Freebsd | Freebsd | 13.3-p1 (including) | 13.3-p1 (including) |
| Freebsd | Freebsd | 13.3-p2 (including) | 13.3-p2 (including) |
| Freebsd | Freebsd | 13.3-p3 (including) | 13.3-p3 (including) |
| Freebsd | Freebsd | 13.3-p4 (including) | 13.3-p4 (including) |
| Freebsd | Freebsd | 13.3-p5 (including) | 13.3-p5 (including) |
| Freebsd | Freebsd | 13.4-beta3 (including) | 13.4-beta3 (including) |
| Freebsd | Freebsd | 14.0 (including) | 14.0 (including) |
| Freebsd | Freebsd | 14.0-beta5 (including) | 14.0-beta5 (including) |
| Freebsd | Freebsd | 14.0-p1 (including) | 14.0-p1 (including) |
| Freebsd | Freebsd | 14.0-p2 (including) | 14.0-p2 (including) |
| Freebsd | Freebsd | 14.0-p3 (including) | 14.0-p3 (including) |
| Freebsd | Freebsd | 14.0-p4 (including) | 14.0-p4 (including) |
| Freebsd | Freebsd | 14.0-p5 (including) | 14.0-p5 (including) |
| Freebsd | Freebsd | 14.0-p6 (including) | 14.0-p6 (including) |
| Freebsd | Freebsd | 14.0-p7 (including) | 14.0-p7 (including) |
| Freebsd | Freebsd | 14.0-p8 (including) | 14.0-p8 (including) |
| Freebsd | Freebsd | 14.0-p9 (including) | 14.0-p9 (including) |
| Freebsd | Freebsd | 14.0-rc3 (including) | 14.0-rc3 (including) |
| Freebsd | Freebsd | 14.0-rc4-p1 (including) | 14.0-rc4-p1 (including) |
| Freebsd | Freebsd | 14.1 (including) | 14.1 (including) |
| Freebsd | Freebsd | 14.1-p1 (including) | 14.1-p1 (including) |
| Freebsd | Freebsd | 14.1-p2 (including) | 14.1-p2 (including) |
| Freebsd | Freebsd | 14.1-p3 (including) | 14.1-p3 (including) |