{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-25940"
      ],
      "details": "`bhyveload -h \u003chost-path\u003e` may be used to grant loader access to the \u003chost-path\u003e directory tree on the host.  Affected versions of bhyveload(8) do not make any attempt to restrict loader\u0027s access to \u003chost-path\u003e, allowing the loader to read any file the host user has access to.\u00a0In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image.  A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root.",
      "id": "GSD-2024-25940",
      "modified": "2024-02-13T06:02:27.132044Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secteam@freebsd.org",
        "ID": "CVE-2024-25940",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "FreeBSD",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "14.0-RELEASE",
                          "version_value": "p5"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "13.2-RELEASE",
                          "version_value": "p10"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "FreeBSD"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "The water cooler. (Note, this is the requested credit)"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "`bhyveload -h \u003chost-path\u003e` may be used to grant loader access to the \u003chost-path\u003e directory tree on the host.  Affected versions of bhyveload(8) do not make any attempt to restrict loader\u0027s access to \u003chost-path\u003e, allowing the loader to read any file the host user has access to.\u00a0In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image.  A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://security.freebsd.org/advisories/FreeBSD-SA-24:01.bhyveload.asc",
            "refsource": "MISC",
            "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:01.bhyveload.asc"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20240419-0004/",
            "refsource": "MISC",
            "url": "https://security.netapp.com/advisory/ntap-20240419-0004/"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "`bhyveload -h \u003chost-path\u003e` may be used to grant loader access to the \u003chost-path\u003e directory tree on the host.  Affected versions of bhyveload(8) do not make any attempt to restrict loader\u0027s access to \u003chost-path\u003e, allowing the loader to read any file the host user has access to.\u00a0In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image.  A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root."
          },
          {
            "lang": "es",
            "value": "`bhyveload -h ` se puede usar para otorgar acceso al cargador al \u00e1rbol de directorios  en el host. Las versiones afectadas de bhyveload(8) no intentan restringir el acceso del cargador a , lo que le permite leer cualquier archivo al que el usuario host tenga acceso. En el modelo bhyveload(8), el host proporciona un userboot.so para arrancar, pero los scripts del cargador generalmente provienen de la imagen del invitado. Se podr\u00eda utilizar un script creado con fines malintencionados para extraer datos confidenciales del host al que puede acceder el usuario que ejecuta bhyhveload(8), que suele ser la ra\u00edz del sistema."
          }
        ],
        "id": "CVE-2024-25940",
        "lastModified": "2024-04-19T07:15:09.657",
        "metrics": {},
        "published": "2024-02-15T05:15:11.100",
        "references": [
          {
            "source": "secteam@freebsd.org",
            "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:01.bhyveload.asc"
          },
          {
            "source": "secteam@freebsd.org",
            "url": "https://security.netapp.com/advisory/ntap-20240419-0004/"
          }
        ],
        "sourceIdentifier": "secteam@freebsd.org",
        "vulnStatus": "Awaiting Analysis"
      }
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "text": "niedrig"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und geh\u00f6rt damit zu den Unix Derivaten.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann eine Schwachstelle in FreeBSD Project FreeBSD OS ausnutzen, um Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0364 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0364.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0364 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0364"
      },
      {
        "category": "external",
        "summary": "FreeBSD Security Advisory vom 2024-02-13",
        "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-24:01.bhyveload.asc"
      },
      {
        "category": "external",
        "summary": "FreeBSD Security Advisory vom 2024-02-13",
        "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-24:02.tty.asc"
      }
    ],
    "source_lang": "en-US",
    "title": "FreeBSD Project FreeBSD OS: Schwachstelle erm\u00f6glicht Offenlegung von Informationen",
    "tracking": {
      "current_release_date": "2024-02-13T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:05:09.922+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-0364",
      "initial_release_date": "2024-02-13T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-02-13T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 14.0",
                "product": {
                  "name": "FreeBSD Project FreeBSD OS \u003c 14.0",
                  "product_id": "T032775"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 13.2",
                "product": {
                  "name": "FreeBSD Project FreeBSD OS \u003c 13.2",
                  "product_id": "T032776"
                }
              }
            ],
            "category": "product_name",
            "name": "FreeBSD OS"
          }
        ],
        "category": "vendor",
        "name": "FreeBSD Project"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-25941",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen im FreeBSD Project FreeBSD OS. Diese Fehler bestehen in den Komponenten jail und bhyeload des Kerns aufgrund einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen."
        }
      ],
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-25941"
    },
    {
      "cve": "CVE-2024-25940",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen im FreeBSD Project FreeBSD OS. Diese Fehler bestehen in den Komponenten jail und bhyeload des Kerns aufgrund einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen."
        }
      ],
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-25940"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-25940"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-922"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-15T05:15:11Z",
    "severity": "MODERATE"
  },
  "details": "`bhyveload -h \u003chost-path\u003e` may be used to grant loader access to the \u003chost-path\u003e directory tree on the host.  Affected versions of bhyveload(8) do not make any attempt to restrict loader\u0027s access to \u003chost-path\u003e, allowing the loader to read any file the host user has access to.\u00a0In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image.  A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root.",
  "id": "GHSA-j347-m6ww-35jg",
  "modified": "2025-06-04T21:31:01Z",
  "published": "2024-02-15T06:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25940"
    },
    {
      "type": "WEB",
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:01.bhyveload.asc"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240419-0004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}