CVE-2024-25940: bhyveload(8) host file access
bhyveload -h <host-path> may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any attempt to restrict loader's access to <host-path>, allowing the loader to read any file the host user has access to. In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image. A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Avoid invoking `bhyveload -h <host-path>` unless you must grant the loader access to that host directory tree; otherwise loader scripts can read any host files the host user can access.
bhyveload(8) -h <host-path> (host path access) = Do not use -h <host-path> except when strictly required
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25940?
CVE-2024-25940 has been classified as a high-severity vulnerability due to its potential to expose sensitive files on the host system.
How do I fix CVE-2024-25940?
To mitigate CVE-2024-25940, ensure you upgrade to a patched version of bhyveload that restricts access to the host-path directory tree.
What systems are affected by CVE-2024-25940?
CVE-2024-25940 affects the FreeBSD bhyveload versions that do not implement restrictions on the loader access to the host-path.
What is the impact of CVE-2024-25940?
The impact of CVE-2024-25940 allows unauthorized file access, which could lead to the exposure of sensitive data on the host.
Are there any workarounds for CVE-2024-25940?
While updates are recommended for CVE-2024-25940, users may temporarily limit access permissions for the host-path to mitigate risks.