Versions Affected : All versions prior to TrueNAS 12.0-U6

---

Description

Certain VirtIO-based device models failed to handle errors when fetching I/O descriptors.

Such errors could be triggered by a malicious guest. As a result, the device model code could be tricked into operating on uninitialized I/O vectors, leading to memory corruption.

---

Workaround

No workaround is available. Virtual machines are unaffected unless they use one or more of the following device models: + virtio-console + virtio-rnd + virtio-scsi (available starting in FreeBSD 12.0)

---

Mitigation

• Upgrade to TrueNAS 12.0-U6 or later.

---

Commit

• FreeBSD Revision : r370393
• TrueNAS Commit : a317b34
• TrueNAS Commit : f4242bd
• JIRA Ticket : NAS-111999

---

Further information

• FreeBSD Errata Notice Entry