CVE-2019-5604

FreeBSD Security Advisory - FreeBSD-SA-19:16.bhyve

Severity Score

9.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In FreeBSD 12.0-STABLE before r350246, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350247, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, the emulated XHCI device included with the bhyve hypervisor did not properly validate data provided by the guest, allowing an out-of-bounds read. This provides a malicious guest the possibility to crash the system or access system memory.

En FreeBSD versión 12.0-STABLE anterior a r350246, versión 12.0-RELEASE anterior a 12.0-RELEASE-p8, versión 11.3-STABLE anterior a r350247, versión 11.3-RELEASE anterior a 11.3-RELEASE-p1, y versión 11.2-RELEASE anterior a 11.2-RELEASE-p12, el dispositivo XHCI emulado incluido con el hipervisor bhyve no comprobó apropiadamente los datos proporcionados por el invitado, lo que permitió una lectura fuera de límites. Esto proporciona a un invitado malicioso la posibilidad de bloquear el sistema o acceder a la memoria de sistema.

The pci_xhci_device_doorbell() function does not validate the 'epid' and 'streamid' provided by the guest, leading to an out-of-bounds read. A misbehaving bhyve guest could crash the system or access memory that it should not be able to.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-01-07 CVE Reserved
2019-07-25 CVE Published
2024-08-04 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-125: Out-of-bounds Read

CAPEC

References (3)

URL	Tag	Source
http://packetstormsecurity.com/files/153753/FreeBSD-Security-Advisory-FreeBSD-SA-19-16.bhyve.html	Third Party Advisory
https://security.netapp.com/advisory/ntap-20190814-0003	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:16.bhyve.asc	2023-03-01

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.0 Search vendor "Freebsd" for product "Freebsd" and version "11.0"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		p10		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		p11		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		p2		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		p3		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		p4		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		p5		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		p6		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		p7		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		p8		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		p9		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2"		rc3		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0"		p1		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0"		p2		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0"		p3		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0"		p4		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0"		p5		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0"		p6		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0"		p7		Affected