Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-5604

In FreeBSD 12.0-STABLE before r350246, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350247, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, the emulated XHCI device included with the bhyve hypervisor did not properly validate data provided by the guest, allowing an out-of-bounds read. This provides a malicious guest the possibility to crash the system or access system memory.

Published

2019-07-26T01:15:10.797

Last Modified

2024-11-21T04:45:13.157

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.6 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:N/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: NONE
  • Availability Impact: COMPLETE
Exploitability Score

8.0

Impact Score

9.2

Weaknesses
  • Type: Primary
    CWE-125
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System freebsd freebsd 11.0 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.2 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 12.0 Yes
Operating System freebsd freebsd 12.0 Yes
Operating System freebsd freebsd 12.0 Yes
Operating System freebsd freebsd 12.0 Yes
Operating System freebsd freebsd 12.0 Yes
Operating System freebsd freebsd 12.0 Yes
Operating System freebsd freebsd 12.0 Yes
Operating System freebsd freebsd 12.0 Yes
References