CVE-2022-35867

CVE-2022-35867 is a local privilege escalation vulnerability affecting xhyve, specifically within the e1000 virtual device. It stems from improper validation of user-supplied data length, leading to a stack-based buffer overflow. An attacker with high-privileged code execution on a guest system can exploit this to gain arbitrary code execution within the hypervisor's context. Rated Medium (CVSS 6.7), this vulnerability requires high privileges and local access, but can lead to complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion.