-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:72.bhyve Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in bhyve device models Category: core Module: bhyve Announced: 2026-10-14 Credits: Brian Delgado from Intel using Anthropic Opus 4.8 Credits: Claude and Ada Logics Credits: Joshua Rogers of AISLE Research Team Credits: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai Affects: All supported versions of FreeBSD. Corrected: 2026-10-14 16:03:00 UTC (stable/15, 15.1-STABLE) 2026-10-14 16:04:40 UTC (releng/15.1, 15.1-RELEASE-p5) 2026-10-14 16:03:16 UTC (stable/14, 14.5-STABLE) 2026-10-14 16:04:14 UTC (releng/14.5, 14.5-RELEASE-p2) 2026-10-14 16:03:57 UTC (releng/14.4, 14.4-RELEASE-p11) CVE Name: CVE-2026-101309, CVE-2026-101310, CVE-2026-101311 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background bhyve(8) is a hypervisor that runs guest operating systems inside a virtual machine. II. Problem Description Several vulnerabilities were found in the bhyve hypervisor's device models. The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. (CVE-2026-101309) The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. (CVE-2026-101310) The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. (CVE-2026-101311) III. Impact A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox. IV. Workaround No workaround is available. Virtual machines that provide none of the "xhci", "hda", and "fbuf" devices to guests are not affected. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Restart all bhyve virtual machines, or reboot the system. Perform one of the following: 1) To update your vulnerable system installed from base system packages: Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base 2) To update your vulnerable system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 15.x] # fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-15.patch # fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-15.patch.asc # gpg --verify bhyve-15.patch.asc [FreeBSD 14.x] # fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-14.patch # fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-14.patch.asc # gpg --verify bhyve-14.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch -E -p0 < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>. Restart all bhyve virtual machines, or reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 07c15b75ff78 stable/15-n286008 releng/15.1/ febb02e3253c releng/15.1-n283638 stable/14/ fa7fe70671ee stable/14-n275355 releng/14.5/ 2e4ec07874a2 releng/14.5-n274893 releng/14.4/ 00ec12d48c63 releng/14.4-n273788 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://www.cve.org/CVERecord?id=CVE-2026-101309> <URL:https://www.cve.org/CVERecord?id=CVE-2026-101310> <URL:https://www.cve.org/CVERecord?id=CVE-2026-101311> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:72.bhyve.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmrPwd8bFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrv2bwP/0+lymnNlkfbBG77FAa2 oaF/qeH2BOZ6ObCykMgevVuidI6NJQmaXrYfM3IaTla3+poi9UrInEz0ppGRpmar SJurTHSKfFMfs3javxDgbOl8bR5Sghi60wFkX0alhZmtQYms5nle+qBFf2rFyGSY I32W6wR+tTjH/Fp5kyqc/3j+CDrfnl2KFUJodu6gZbWIprPcoU+vIWVP3NH9hc68 RAOAyKXzgufOV+lyxyDbL8tCTO50W4sMvMeMxSguaffbfn/x0aG2Y6ohONAWdY0W 6rGrtDhqojg/zXWbau5tqFBLUy+Z+k7cCatr2TBGdHujvxTiQ7qV3taJGXol66yN K6PHRZzgYMcBE9eqjqxYMEr9pQyXHNLNspGnZxZVMSj/t4dD11MGV7GiG3jOL8Wz GBQIxE0ePvMYLudZPjsfrPmbAPTt1+KDq0ML/l7jFwGuDEbcsNum5IKtIGpkVmO3 ehrfIF8USvvsPrszviJ1bSorZsmAGoO1hO4JvvyxnO1WbMW+6TFV3KBl3Vuo3gVR gD9KRuM2aV3r4C5hRxTAx7386ryP6f0tR16JQo97O4pnFXz6SyNluWxdmf/3hkgo gOq9QCVxtBPL3k5TrCkz8dTpODz6Ji81NDLAADtK2M4+IPHV/5xMpLgXnfU9t/eV kCHlcMVuNaS38EzrcYtCWqQN =bQls -----END PGP SIGNATURE-----
No comments:
Post a Comment