{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-29T07:07:28.700","vulnerabilities":[{"cve":{"id":"CVE-2023-3494","sourceIdentifier":"secteam@freebsd.org","published":"2023-08-01T23:15:31.053","lastModified":"2025-02-13T17:16:57.040","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports.  The interface lets the guest copy a string into a buffer resident in the bhyve process' memory.  A bug in the state machine implementation can result in a buffer overflowing when copying this string. Malicious, privileged software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root, mitigated by the capabilities assigned through the Capsicum sandbox available to the bhyve process."},{"lang":"es","value":"El controlador fwctl implementa una máquina de estados que se ejecuta cuando un huésped bhyve accede a ciertos puertos de E/S x86.  La interfaz permite al huésped copiar una cadena en un búfer residente en la memoria del proceso bhyve.  Un error en la implementación de la máquina de estado puede provocar el desbordamiento del búfer al copiar esta cadena. El software malicioso y privilegiado que se ejecuta en una máquina virtual huésped puede explotar el desbordamiento del búfer para lograr la ejecución de código en el host en el proceso de espacio de usuario bhyve, que normalmente se ejecuta como root, mitigado por las capacidades asignadas a través de la caja de arena Capsicum disponible para el proceso bhyve."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"weaknesses":[{"source":"secteam@freebsd.org","type":"Secondary","description":[{"lang":"en","value":"CWE-120"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-120"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:-:*:*:*:*:*:*","matchCriteriaId":"DEEE6D52-27E4-438D-AE8D-7141320B5973"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:b1-p1:*:*:*:*:*:*","matchCriteriaId":"66364EA4-83B1-4597-8C18-D5633B361A9C"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:b2-p2:*:*:*:*:*:*","matchCriteriaId":"EF9292DD-EFB1-4B50-A941-7485D901489F"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:p1:*:*:*:*:*:*","matchCriteriaId":"EFB18F55-4F5C-4166-9A7E-6F6617179A90"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:p2:*:*:*:*:*:*","matchCriteriaId":"66E1C269-841F-489A-9A0A-5D145B417E0A"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:p3:*:*:*:*:*:*","matchCriteriaId":"ECF1B567-F764-45F5-A793-BEA93720F952"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:p4:*:*:*:*:*:*","matchCriteriaId":"DAFE3F33-2C57-4B52-B658-82572607BD8C"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:p5:*:*:*:*:*:*","matchCriteriaId":"C925DF75-2785-44BD-91CA-66D29C296689"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:p6:*:*:*:*:*:*","matchCriteriaId":"BCE2DAEC-81A5-49E9-B7E7-4F143FA6B3F7"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:p7:*:*:*:*:*:*","matchCriteriaId":"7725D503-1437-4F90-B30C-007193D5F0E1"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:p8:*:*:*:*:*:*","matchCriteriaId":"49CDE3D8-2924-42B9-8778-C5A517F5451E"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.1:rc1-p1:*:*:*:*:*:*","matchCriteriaId":"B536EE52-ED49-4A85-BC9D-A27828D5A961"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*","matchCriteriaId":"A87EFA20-DD6B-41C5-98FD-A29F67D2E732"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*","matchCriteriaId":"2888B0C1-4D85-42EC-9696-03FAD0A9C28F"}]}]}],"references":[{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-23:07.bhyve.asc","source":"secteam@freebsd.org","tags":["Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230831-0006/","source":"secteam@freebsd.org"},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-23:07.bhyve.asc","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230831-0006/","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}