Bhyve e82545 device emulation out-of-bounds write
Description
The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload ("TSO"). The e1000 device model uses an on-stack buffer to generate the modified packet header when simulating these modifications on transmitted packets.
When checksum offload is requested for a transmitted packet, the e1000 device model used a guest-provided value to specify the checksum offset in the on-stack buffer. The offset was not validated for certain packet types.
A misbehaving bhyve guest could overwrite memory in the bhyve process on the host, possibly leading to code execution in the host context.
The bhyve process runs in a Capsicum sandbox, which (depending on the FreeBSD version and bhyve configuration) limits the impact of exploiting this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An out-of-bounds write in FreeBSD bhyve's e1000 emulation allows a malicious guest to potentially execute code on the host.
Vulnerability
The e1000 network adapter device model in FreeBSD's bhyve hypervisor (all supported versions) uses an on-stack buffer to modify packet headers when performing checksum offload. A guest-provided checksum offset is not validated for certain packet types, leading to an out-of-bounds write on the host stack [1].
Exploitation
An attacker with ability to send crafted network packets from a bhyve guest can trigger the out-of-bounds write by requesting checksum offload with a malicious offset value. No additional authentication is required beyond guest access.
Impact
Successful exploitation allows the guest to overwrite memory in the bhyve host process, potentially leading to arbitrary code execution in the host context. The impact is partially mitigated by the Capsicum sandbox, which restricts host privileges depending on FreeBSD version and configuration [1].
Mitigation
The vulnerability is fixed in FreeBSD stable/13 (13.1-STABLE), releng/13.1 (13.1-RC1-p1), releng/13.0 (13.0-RELEASE-p11), stable/12 (12.3-STABLE), and releng/12.3 (12.3-RELEASE-p5), announced on 2022-04-06. Users should upgrade or apply the patch from the FreeBSD advisory [1].
AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.