Versions Affected : All versions prior to TrueNAS 13.0-U2

---

Description

The implementation of lib9p’s handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory.

The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process. This could potentially lead to user-mode code execution on the host, subject to bhyve’s Capsicum sandbox.

---

Workaround

No workaround is available. Systems not using bhyve’s virtio-9p device model are not affected.

---

Mitigation

• Upgrade to TrueNAS 13.0-U2 or later.

---

Commit

• FreeBSD Revision Hash: 7dfe949791e7
• TrueNAS Commit
• TrueNAS Commit
• JIRA Ticket : NAS-117683

---

Further information

• FreeBSD Errata Notice Entry