CVE-2024-41928: bhyve(8) privileged guest escape via TPM device passthrough

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-05 · updated 2026-06-17
Weakness: CWE-125

Description

Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process.

Affected products

FreeBSD: from 14.1 before 14.1_p4; from 14.0 before 14.0_p10 — fixed in 14.0_p10, 14.1_p4

How to fix

Upgrade to a fixed version: FreeBSD 14.0_p10, 14.1_p4. Check the vendor advisory for mitigations.

References

https://security.freebsd.org/advisories/FreeBSD-SA-24:10.bhyve.asc
https://security.netapp.com/advisory/ntap-20240920-0009/

Get alerted when CVE-2024-41928 or the next vulnerability affects your stack