CVE-2020-24718

bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying VMCS_HOST_RIP.

• CWE-862

• https://github.com/illumos/illumos-gate/blob/84971882a96ac0fecd538b02208054a872ff8af3/usr/src/uts/i86pc/io/vmm/intel/vmcs.c#L246-L249Exploit, Third Party Advisory
• https://security.FreeBSD.org/advisories/FreeBSD-SA-20:28.bhyve_vmcs.ascVendor Advisory
• https://security.netapp.com/advisory/ntap-20201016-0002/Third Party Advisory
• https://github.com/illumos/illumos-gate/blob/84971882a96ac0fecd538b02208054a872ff8af3/usr/src/uts/i86pc/io/vmm/intel/vmcs.c#L246-L249Exploit, Third Party Advisory
• https://security.FreeBSD.org/advisories/FreeBSD-SA-20:28.bhyve_vmcs.ascVendor Advisory
• https://security.netapp.com/advisory/ntap-20201016-0002/Third Party Advisory

Published

Sep 25, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24712Cross Site Scripting (XSS) vulnerability in Gophish before 0…5.4
• CVE-2020-24713Gophish through 0.10.1 does not invalidate the gophish cooki…7.5
• CVE-2020-24714The Scalyr Agent before 2.1.10 has Missing SSL Certificate V…9.8
• CVE-2020-24715The Scalyr Agent before 2.1.10 has Missing SSL Certificate V…9.8
• CVE-2020-24716OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execu…7.8
• CVE-2020-24717OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterpret…7.8
• CVE-2020-24719Exposed Erlang Cookie could lead to Remote Command Execution…9.8
• CVE-2020-24721An issue was discovered in the GAEN (aka Google/Apple Exposu…5.7
• CVE-2020-24722An issue was discovered in the GAEN (aka Google/Apple Exposu…5.9
• CVE-2020-24723Cross Site Scripting (XSS) vulnerability in the Registration…4.8
• CVE-2020-24736Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and …5.5
• CVE-2020-24739A CSRF vulnerability was found in iCMS v7.0.0 in the backgro…6.5