CVE-2024-45289

The fetch(3) library in FreeBSD contains an improper initialization vulnerability where it incorrectly handles environment variables used to pass the revocation file pathname. Specifically, the environment variable name used by fetch(1) to communicate the filename to the library is incorrect, cau...

CVE-2024-45289 Unbounded allocation in ctl(4) CAM Target Layer

The fetch3 library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch1 to pass the filename to the library was incorrect, in effect ignoring the option. Fetch would still connect to a host presenting a...

CVE-2024-39281 Unbounded allocation in ctl(4) CAM Target Layer

The command ctlpersistentreserveout allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator...

CVE-2024-39281

A vulnerability exists in the FreeBSD ctl subsystem, specifically in the ctl(4) CAM Target Layer . The ctl_persistent_reserve_out command fails to properly validate the size argument, allowing a caller to specify an arbitrary size that is passed directly to the kernel's memory allocator. This res...

CVE-2024-39281 Unbounded allocation in ctl(4) CAM Target Layer

The command ctlpersistentreserveout allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator...

FreeBSD -- Unbounded allocation in ctl(4) CAM Target Layer

Problem Description: The command ctlpersistentreserveout allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator. Impact: A malicious guest could cause a Denial of Service DoS on the host...

CVE-2024-45063 Multiple issues in ctl(4) CAM Target Layer

The function ctlwritebuffer incorrectly set a flag which resulted in a kernel Use-After-Free when a command finished processing. Malicious software running in a guest VM that exposes virtioscsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process,...

CVE-2024-43110 Multiple issues in ctl(4) CAM Target Layer

The ctlrequestsense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM that exposes virtioscsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note th...