VYPR
← All advisories
High severity8.8NVD Advisory· Published Sep 5, 2024· Updated Jun 17, 2026

CVE-2024-42416

CVE-2024-42416

Description

The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory.

Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

28
  • FreeBSD/virtio_scsillm-create
  • Bhyve/bhyvellm-create
  • FreeBSD/FreeBSDv526 versions
    14.1-RELEASE+ 25 more
    • (no CPE)range: 14.1-RELEASE
    • cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*range: >=13.0,<13.3
    • cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:13.3:p4:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:13.3:p5:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:13.4:beta3:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:p8:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:p9:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.1:-:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.1:p2:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:14.1:p3:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.