{"cve":"CVE-2023-3494","nvd":{"published":"2023-08-01T23:15:31.053","modified":"2026-06-17T06:14:12.840","status":"Modified","description":"The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports.  The interface lets the guest copy a string into a buffer resident in the bhyve process' memory.  A bug in the state machine implementation can result in a buffer overflowing when copying this string. Malicious, privileged software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root, mitigated by the capabilities assigned through the Capsicum sandbox available to the bhyve process.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8},"cwes":["CWE-120"],"references":["https://security.FreeBSD.org/advisories/FreeBSD-SA-23:07.bhyve.asc","https://security.netapp.com/advisory/ntap-20230831-0006/","https://security.FreeBSD.org/advisories/FreeBSD-SA-23:07.bhyve.asc","https://security.netapp.com/advisory/ntap-20230831-0006/"],"products":["freebsd:freebsd"],"source":"nvd","synced_at":"2026-10-19T21:38:35.729974749+00:00"},"epss":{"cve":"CVE-2023-3494","score":0.0023,"percentile":0.13925,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}