CVE-2024-42416

CVE-2024-42416 is a high-severity vulnerability affecting FreeBSD, specifically within the ctl_report_supported_opcodes function. It allows for an arbitrary write to a limited amount of kernel heap memory due to insufficient validation of user-provided fields. This flaw can be exploited by malicious software in a guest VM exposing virtio_scsi to achieve code execution on the host's bhyve userspace process, or by a malicious iSCSI initiator to gain remote code execution on the iSCSI target host. The CVSS score is 8.8 (High), indicating a local attack vector with low complexity and high impact on confidentiality, integrity, and availability, though constrained by the bhyve sandbox. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.