143 lines
5.5 KiB
Text
143 lines
5.5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-16:38.bhyve Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: bhyve(8) virtual machine escape
|
|
|
|
Category: core
|
|
Module: bhyve
|
|
Announced: 2016-12-06
|
|
Credits: Felix Wilhelm
|
|
Affects: FreeBSD 10.x, FreeBSD 11.0
|
|
Corrected: 2016-12-06 18:54:43 UTC (stable/11, 11.0-STABLE)
|
|
2016-12-06 18:49:38 UTC (releng/11.0, 11.0-RELEASE-p4)
|
|
2016-12-06 18:55:01 UTC (stable/10, 10.3-STABLE)
|
|
2016-12-06 18:49:48 UTC (releng/10.3, 10.3-RELEASE-p13)
|
|
2016-12-06 18:49:54 UTC (releng/10.2, 10.2-RELEASE-p26)
|
|
2016-12-06 18:49:59 UTC (releng/10.1, 10.1-RELEASE-p43)
|
|
CVE Name: CVE-2016-1889
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
bhyve(8) is a hypervisor that supports running a variety of virtual
|
|
machines (guests).
|
|
|
|
II. Problem Description
|
|
|
|
The bounds checking of accesses to guest memory greater than 4GB by
|
|
device emulations is subject to integer overflow.
|
|
|
|
III. Impact
|
|
|
|
For a bhyve virtual machine with more than 3GB of guest memory configured,
|
|
a malicious guest could craft device descriptors that could give it access
|
|
to the heap of the bhyve process. Since the bhyve process is running as root,
|
|
this may allow guests to obtain full control of the hosts they're running on.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, however, systems not using bhyve(8) for
|
|
virtualization are not vulnerable. Additionally, systems using bhyve(8) with
|
|
3GB or less of configured guest memory are not vulnerable.
|
|
|
|
V. Solution
|
|
|
|
Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
No reboot is needed. Rather the bhyve(8) process for vulnerable virtual
|
|
machines should be restarted.
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the amd64
|
|
platform can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 11.0, FreeBSD 10.3]
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:38/bhyve.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:38/bhyve.patch.asc
|
|
# gpg --verify bhyve.patch.asc
|
|
|
|
[FreeBSD 10.2, FreeBSD 10.1]
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:38/bhyve-10.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:38/bhyve-10.patch.asc
|
|
# gpg --verify bhyve-10.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/10/ r309648
|
|
releng/10.1/ r309636
|
|
releng/10.2/ r309635
|
|
releng/10.3/ r309634
|
|
stable/11/ r309647
|
|
releng/11.0/ r309633
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1889>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:38.bhyve.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQIcBAEBCgAGBQJYRw1wAAoJEO1n7NZdz2rnepoP/1b6uXh8BFW8Qi9cVyfUkldC
|
|
aRfAdmE3azyJCwTY2cipIA+qp9SJUxnLf1lPicERIPZY6iiC6Zm1Qi+cfwCvgczu
|
|
ksY9aYOM7/v1jKuUrPf7tJZ5OokRzkL8W2uCKqAn2BODBK1mA4yy8yGthgyCT6bH
|
|
JzvINPnlQzJKHCdp/8goRVITxa+kMF7UBbpPDAkHuBNKKNRLOYb50Z9G7BZp9/u6
|
|
/Y8avPVCOnU7WKDehG6FgyfE0Z+pUw6dAgpYNblsdQc148xGCSoHyHjXIX1jHzCv
|
|
ZChUhj+6m7CQkjh/GG6x1Bz1lCcsIgsnPAAuQC0WqsaQRnUWJXjTyPMHwkxIHlD7
|
|
sFGPdM4RdMI0O95xMm9Dy05baNsAtBr6DExd48jFv/qbUio9FhUNUJ5rfQEAnyp2
|
|
aAZL34rd90KPFn5zp8EhskOPWGJp7lr+5FpV1m85R07qRES9875eWWYUW5H+yZK+
|
|
kwUcRKiYyvAFTx7Ag38pCtH4SVZ4zRV0mBZnOvchNosMSJz+tZYxApaXHY/nBJck
|
|
wCr+v4DlB9x4LKt9CnB1ow+YqVsMuPyXwyj4e9Pyw/zkvW1aA/TJeUonmm1c2vI4
|
|
07b64wnTsvLGgbhN2ei8LPtAEwpN/DBn7D098Zwf4CfCGQ2VZQeC5AjyTSX9bvy/
|
|
WnKlRTDLDrFSpAD/1/Dz
|
|
=ts3q
|
|
-----END PGP SIGNATURE-----
|