bhyve privileged guest escape via fwctl
Priority MEDIUM 40CWE-120Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports. The interface lets the guest copy a string into a buffer resident in the bhyve process' memory. A bug in the state machine implementation can result in a buffer overflowing when copying this string. Malicious, privileged software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root, mitigated by the capabilities assigned through the Capsicum sandbox available to the bhyve process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Fix Fixed FreeBSD (FreeBSD): 13.2-RELEASE-p2, 13.1-RELEASE-p9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FreeBSD | FreeBSD | 13.2-RELEASE to before 13.2-RELEASE-p2; 13.1-RELEASE to before 13.1-RELEASE-p9 | 13.2-RELEASE-p2, 13.1-RELEASE-p9 | Patch available | CNA |
- FreeBSD VendorFreeBSD Affected 13.2-RELEASE to before 13.2-RELEASE-p2; 13.1-RELEASE to before 13.1-RELEASE-p9 Fixed in 13.2-RELEASE-p2, 13.1-RELEASE-p9 Patch available CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:13.1:-:*:*:*:*:*:* | 13.1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.1:b1-p1:*:*:*:*:*:* | 13.1 b1-p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.1:b2-p2:*:*:*:*:*:* | 13.1 b2-p2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.1:p1:*:*:*:*:*:* | 13.1 p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.1:p2:*:*:*:*:*:* | 13.1 p2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.1:p3:*:*:*:*:*:* | 13.1 p3 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.1:p4:*:*:*:*:*:* | 13.1 p4 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.1:p5:*:*:*:*:*:* | 13.1 p5 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.1:p6:*:*:*:*:*:* | 13.1 p6 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.1:p7:*:*:*:*:*:* | 13.1 p7 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:13.1:-:*:*:*:*:*:* Versions 13.1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.1:b1-p1:*:*:*:*:*:* Versions 13.1 b1-p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.1:b2-p2:*:*:*:*:*:* Versions 13.1 b2-p2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.1:p1:*:*:*:*:*:* Versions 13.1 p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.1:p2:*:*:*:*:*:* Versions 13.1 p2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.1:p3:*:*:*:*:*:* Versions 13.1 p3 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.1:p4:*:*:*:*:*:* Versions 13.1 p4 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.1:p5:*:*:*:*:*:* Versions 13.1 p5 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.1:p6:*:*:*:*:*:* Versions 13.1 p6 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.1:p7:*:*:*:*:*:* Versions 13.1 p7 Vulnerable ·FreeBSD
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:13.1:p8:*:*:*:*:*:* | 13.1 p8 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.1:rc1-p1:*:*:*:*:*:* | 13.1 rc1-p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:* | 13.2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:* | 13.2 p1 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:13.1:p8:*:*:*:*:*:* Versions 13.1 p8 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.1:rc1-p1:*:*:*:*:*:* Versions 13.1 rc1-p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:* Versions 13.2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:* Versions 13.2 p1 Vulnerable ·FreeBSD
Remediation
- Fix · CNA FreeBSD (FreeBSD) Fixed in 13.2-RELEASE-p2, 13.1-RELEASE-p9
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3494
- 2026-10-03 Alias added: GHSA-6672-m2hq-hwm4
References
More Freebsd vulnerabilities
- TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
- TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
- TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
- TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
Sources
- CVE-2023-3494 · CVE Program
- CVE-2023-3494 · NVD
- FIRST EPSS
- GHSA-6672-m2hq-hwm4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences