CVE-2019-5609

HIGH

FreeBSD bhyve e1000 Device Emulation Out-of-bounds Write

Title source: llm
STIX 2.1

Description

In FreeBSD 12.0-STABLE before r350619, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350619, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE before 11.2-RELEASE-p13, the bhyve e1000 device emulation used a guest-provided value to determine the size of the on-stack buffer without validation when TCP segmentation offload is requested for a transmitted packet. A misbehaving bhyve guest could overwrite memory in the bhyve process on the host.

References (2)

Core 2
Core References
Patch, Vendor Advisory x_refsource_confirm
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:21.bhyve.asc
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20190910-0002/

Scores

CVSS v3 7.5
EPSS 0.0035
EPSS Percentile 57.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-787
Status published
Products (3)
freebsd/freebsd 11.2 (13 CPE variants)
freebsd/freebsd 11.3 (5 CPE variants)
freebsd/freebsd 12.0 (6 CPE variants)
Published Aug 30, 2019
Tracked Since Feb 18, 2026