Read the docs
TI-2024-17040 Aliases CVE-2024-25940GHSA-j347-m6ww-35jg

bhyveload(8) host file access

Priority LOW 29CWE-922Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-922.

Summary

`bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any attempt to restrict loader's access to <host-path>, allowing the loader to read any file the host user has access to. In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image. A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00506 43rd percentileScored 2026-11-07
Fix Fixed FreeBSD (FreeBSD): p5, p10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreeBSDFreeBSD14.0-RELEASE to before p5; 13.2-RELEASE to before p10p5, p10Patch availableCNA
  • FreeBSD VendorFreeBSD Affected 14.0-RELEASE to before p5; 13.2-RELEASE to before p10 Fixed in p5, p10 Patch available CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*before 13.2; 13.3 to before 14.0VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*13.2 p1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:*13.2 p2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:*13.2 p3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:*13.2 p4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.2:p5:*:*:*:*:*:*13.2 p5VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.2:p6:*:*:*:*:*:*13.2 p6VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.2:p7:*:*:*:*:*:*13.2 p7VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.2:p8:*:*:*:*:*:*13.2 p8VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.2:p9:*:*:*:*:*:*13.2 p9VulnerableFreeBSD
  • cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* Versions before 13.2; 13.3 to before 14.0 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:* Versions 13.2 p1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:* Versions 13.2 p2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:* Versions 13.2 p3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:* Versions 13.2 p4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.2:p5:*:*:*:*:*:* Versions 13.2 p5 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.2:p6:*:*:*:*:*:* Versions 13.2 p6 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.2:p7:*:*:*:*:*:* Versions 13.2 p7 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.2:p8:*:*:*:*:*:* Versions 13.2 p8 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.2:p9:*:*:*:*:*:* Versions 13.2 p9 Vulnerable ·FreeBSD
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*14.0 beta5VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*14.0 p1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*14.0 p2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*14.0 p3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*14.0 p4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*14.0 rc3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*14.0 rc4-p1VulnerableFreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:* Versions 14.0 beta5 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:* Versions 14.0 p1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:* Versions 14.0 p2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:* Versions 14.0 p3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:* Versions 14.0 p4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:* Versions 14.0 rc3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:* Versions 14.0 rc4-p1 Vulnerable ·FreeBSD

Remediation

  • Fix · CNA FreeBSD (FreeBSD) Fixed in p5, p10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FreeBSD p10, p5

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25940
  2. 2026-10-03 Alias added: GHSA-j347-m6ww-35jg

References

Advisory 2

  • TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
  • TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
  • TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
  • TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
See all 576 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences