CVE-2024-8178

CVE-2024-8178 is a high-severity vulnerability affecting FreeBSD, specifically within the ctl_write_buffer and ctl_read_buffer functions, which fail to initialize allocated memory. This flaw allows malicious software in a guest VM exposing virtio_scsi to achieve code execution on the host's bhyve userspace process, typically running as root, or a malicious iSCSI initiator to gain remote code execution on the iSCSI target host. With a CVSS score of 8.8 (HIGH), the vulnerability has a local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability, despite bhyve's Capsicum sandbox. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.