FreeBSD 13.0 Patch 11

The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory. The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process. This could potentially lead to user-mode code execution on the host, subject to bhyve's Capsicum sandbox.

Published: 2024-02-15T05:13:50.356Z
Updated: 2025-02-13T16:29:03.221Z

A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different root cause. An unprivileged local user process can maintain a mapping of a page after it is freed, allowing that process to read private data belonging to other processes or the kernel.

Published: 2024-02-15T05:11:35.101Z
Updated: 2025-02-13T16:29:02.596Z

The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may cause the reference count to overflow, leading to a use after free (UAF).

Published: 2024-02-15T05:09:27.389Z
Updated: 2025-03-28T23:57:52.965Z

When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An out-of-bound read can happen when user constructs a specially crafted ps_string, which in turn can cause the kernel to crash.

Published: 2024-02-15T05:07:13.996Z
Updated: 2025-03-13T21:52:54.797Z