CVE-2022-35867

2022-08-0316:15:08

CWE-121

[email protected]

web.nvd.nist.gov

cve-2022-35867

privilege escalation

xhyve

vulnerability

nvd

zdi-can-15056

security

information security

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

28.6%

JSON

This vulnerability allows local attackers to escalate privileges on affected installations of xhyve. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the e1000 virtual device. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-15056.

Affected configurations

Vulners

NVD

Node

xhyvexhyveRange≤0.2.0

CPENameOperatorVersion
xhyve_project:xhyvexhyve project xhyveeq0.2.0

CPE	Name	Operator	Version
xhyve_project:xhyve	xhyve project xhyve	eq	0.2.0

CNA Affected

[
  {
    "product": "xhyve",
    "vendor": "xhyve",
    "versions": [
      {
        "status": "affected",
        "version": "0.2.0-145-g83516a"
      }
    ]
  }
]