This vulnerability allows local attackers to escalate privileges on affected...
Vulnerability Description
This vulnerability allows local attackers to escalate privileges on affected installations of xhyve. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the e1000 virtual device. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-15056.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-35867
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Alisa Esage of Zero Day Engineering (zerodayengineering.com)
Affected Vendor
xhyve
View all reports →