Brian Delgado

**Name of the Vulnerable Software and Affected Versions** bhyve (affected versions not specified) **Description** The xHCI (USB 3) device model fails to validate or save the event ring size provided by the guest. Because the size is re-read from guest memory during each use, Transfer Request Block (TRB) fields are loaded without protection against concurrent modification by the guest. This creates a race condition—a situation where the timing or sequence of events affects the outcome—that can be triggered by a guest running malicious, privileged code. This may result in a crash of the bhyve process or the execution of arbitrary code within the host userspace context, limited by the Capsicum sandbox. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** bhyve (affected versions not specified) **Description** The HDA audio device model fails to verify zero-length Buffer Descriptor List (BDL) entries when initiating a stream. This oversight leads to out-of-bounds read or write operations during Direct Memory Access (DMA) transfer processing, where DMA is a feature allowing hardware to access main system memory independently of the CPU. Additionally, BDL fields can be modified by the guest after they have been validated. A malicious guest could exploit these issues to crash the bhyve process or potentially execute arbitrary code within the host userspace context, although this is limited by the Capsicum sandbox, a security framework that restricts the capabilities of a process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** bhyve (affected versions not specified) **Description** The framebuffer device model contains duplicated maximum resolution constants between the framebuffer and RFB modules that are out of sync. Furthermore, writes to the framebuffer BAR allow the setting of arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads lack synchronization. A malicious guest could exploit these issues to crash the bhyve process or potentially execute arbitrary code within the host userspace context running the virtual machine, although this is subject to the Capsicum sandbox, a security mechanism that limits the system calls a process can make. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.