CVE-2022-23092highCWE-787

CVE-2022-23092: falha de alta gravidade em FreeBSD

Missing bounds check in 9p message handling

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar FreeBSD

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.7%
The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory. The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process. This could potentially lead to user-mode code execution on the host, subject to bhyve's Capsicum sandbox.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
FreeBSD · FreeBSD
CVEs relacionadas — FreeBSD

No mesmo produto, das mais perigosas para as menos.

CVE-2018-17157—CVE-2018-17157EPSS 24.2%CVE-2017-1084—CVE-2017-1084EPSS 15.3%CVE-2025-14558HIGHRemote code execution via ND6 Router AdvertisementsEPSS 6.7%CVE-2019-5600—CVE-2019-5600EPSS 4.9%CVE-2018-17158—CVE-2018-17158EPSS 4.4%CVE-2018-6918—CVE-2018-6918EPSS 4.2%