Multiple issues in ctl(4) CAM Target Layer

Vulnerability

CVE-2024-8178 is an uninitialized memory disclosure vulnerability in the FreeBSD ctl(4) CAM Target Layer. The ctl_write_buffer and ctl_read_buffer functions allocate memory to be returned to userspace without initializing it, potentially leaking sensitive kernel heap contents. All supported versions of FreeBSD are affected; the vulnerability was corrected in stable/14, releng/14.1, releng/14.0, stable/13, releng/13.4, and releng/13.3 branches on 2024-09-04 [1].

Exploitation

An attacker requires the ability to interact with the ctl subsystem. In a bhyve(8) hypervisor scenario, malicious software running in a guest VM that exposes virtio_scsi can trigger the vulnerability to leak kernel heap data back to the guest. Alternatively, a malicious iSCSI initiator can exploit the vulnerability against a FreeBSD iSCSI target (`ctld`) to leak memory over the network. No special privilege beyond the ability to send SCSI commands is needed; the vulnerable code paths are reachable by any SCSI initiator [1].

Impact

Successful exploitation results in the disclosure of uninitialized kernel heap memory to the attacker. The leaked memory may contain sensitive information such as kernel pointers, credentials, or other data that could facilitate further attacks. In a bhyve(8) context, the disclosure occurs within the bhyve userspace process, which runs as root but is constrained by a Capsicum sandbox. The vulnerability alone does not directly provide code execution, but the leaked information can be used to bypass mitigations (e.g., ASLR) and enable follow-on exploitation [1].

Mitigation

FreeBSD has released patches for all supported branches: update to 14.1-RELEASE-p4, 14.0-RELEASE-p10, 13.4-RC2-p1, 13.3-RELEASE-p6, or later versions of the respective stable branches. System administrators should apply the security update as soon as possible. No workarounds are currently documented. The vulnerability is listed in the CVE database as CVE-2024-8178 and is part of a set of bugs addressed in FreeBSD-SA-24:11.ctl [1].