CVE-2019-5609

Related Files

FreeBSD Security Advisory - FreeBSD-SA-19:21.bhyve

Posted Aug 6, 2019

Authored by Reno Robert | Site security.freebsd.org

FreeBSD Security Advisory - The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload ("TSO"). The e1000 device model uses an on-stack buffer to generate the modified packet header when simulating these modifications on transmitted packets. When TCP segmentation offload is requested for a transmitted packet, the e1000 device model used a guest-provided value to determine the size of the on-stack buffer without validation. The subsequent header generation could overflow an incorrectly sized buffer or indirect a pointer composed of stack garbage. A misbehaving bhyve guest could overwrite memory in the bhyve process on the host.

tags | advisory, overflow, tcp

systems | freebsd

advisories | CVE-2019-5609

SHA-256 | 5e5c704f8d1d9d95ef61652110af66385c6af7587e83674bd336e945b3308d47

Download | Favorite | View