`bhyveload -h ` may be used to grant loader access to the directory tree on the host. Affected versions of bhyveload(8) do not make any attempt to restrict loader\'s access to , allowing the loader to read any file the host user has access to. In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image. A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root.
Priority: --
CVSS v3: --
Component:
Publish Date: Feb 15, 2024
Related ID: --
CVSS v2: --
Modified Date: Feb 15, 2024
Find out more about CVE-2024-25940 from the MITRE-CVE dictionary and NIST NVD
Login may be required to access defects or downloads.
| Product Name |
Status |
Defect |
Fixed |
Downloads |
| Linux |
| Wind River Linux LTS 17 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux 8 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux 9 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux 7 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux LTS 21 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux LTS 22 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux LTS 18 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux LTS 19 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux CD release |
N/A |
-- |
-- |
-- |
| Wind River Linux 6 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux LTS 23 |
Not Vulnerable |
-- |
-- |
-- |
| VxWorks |
| VxWorks 7 |
Not Vulnerable |
-- |
-- |
-- |
| VxWorks 6.9 |
Not Vulnerable |
-- |
-- |
-- |
| Helix Virtualization Platform Cert Edition |
| Helix Virtualization Platform Cert Edition |
Not Vulnerable |
-- |
-- |
-- |
| Product Name |
Status |
Defect |
Fixed |
Downloads |
Notes
Requires LTSS - customers must have active LTSS (Long Term Security Shield) Support to receive up-to-date information about vulnerabilities that may affect legacy software. Please contact your Wind River account team or see https://docs.windriver.com/bundle/Support_and_Maintenance_Supplemental_Terms_and_Conditions and https://support2.windriver.com/index.php?page=plc for more information.
