bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying VMCS_HOST_RIP.
| Software | From | Fixed in |
|---|---|---|
| freebsd / freebsd | 12.0-p1 | 12.0-p1.x |
| freebsd / freebsd | - | 11.2.x |
| freebsd / freebsd | 12.0 | 12.0.x |
| freebsd / freebsd | 12.0-p3 | 12.0-p3.x |
| freebsd / freebsd | 11.3-rc3 | 11.3-rc3.x |
| freebsd / freebsd | 12.0-p2 | 12.0-p2.x |
| freebsd / freebsd | 12.0-p4 | 12.0-p4.x |
| freebsd / freebsd | 12.0-p5 | 12.0-p5.x |
| freebsd / freebsd | 12.0-p6 | 12.0-p6.x |
| freebsd / freebsd | 11.3 | 11.3.x |
| freebsd / freebsd | 11.3-p1 | 11.3-p1.x |
| freebsd / freebsd | 11.3-p3 | 11.3-p3.x |
| freebsd / freebsd | 11.3-p2 | 11.3-p2.x |
| freebsd / freebsd | 12.0-p8 | 12.0-p8.x |
| freebsd / freebsd | 12.1-p1 | 12.1-p1.x |
| freebsd / freebsd | 12.1 | 12.1.x |
| freebsd / freebsd | 11.3-p4 | 11.3-p4.x |
| freebsd / freebsd | 11.3-p5 | 11.3-p5.x |
| freebsd / freebsd | 11.3-p6 | 11.3-p6.x |
| freebsd / freebsd | 12.0-p7 | 12.0-p7.x |
| freebsd / freebsd | 12.0-p9 | 12.0-p9.x |
| freebsd / freebsd | 12.0-p10 | 12.0-p10.x |
| freebsd / freebsd | 12.0-p11 | 12.0-p11.x |
| freebsd / freebsd | 12.0-p12 | 12.0-p12.x |
| freebsd / freebsd | 12.1-p2 | 12.1-p2.x |
| freebsd / freebsd | 11.3-p7 | 11.3-p7.x |
| freebsd / freebsd | 12.1-p3 | 12.1-p3.x |
| freebsd / freebsd | 12.1-p4 | 12.1-p4.x |
| freebsd / freebsd | 11.3-p8 | 11.3-p8.x |
| freebsd / freebsd | 11.4-beta1 | 11.4-beta1.x |
| freebsd / freebsd | 11.4 | 11.4.x |
| freebsd / freebsd | 12.1-p5 | 12.1-p5.x |
| freebsd / freebsd | 11.3-p9 | 11.3-p9.x |
| freebsd / freebsd | 11.4-rc2 | 11.4-rc2.x |
| freebsd / freebsd | 11.4-rc1 | 11.4-rc1.x |
| freebsd / freebsd | 12.1-p6 | 12.1-p6.x |
| freebsd / freebsd | 11.3-p10 | 11.3-p10.x |
| freebsd / freebsd | 11.3-p11 | 11.3-p11.x |
| freebsd / freebsd | 11.4-p1 | 11.4-p1.x |
| freebsd / freebsd | 12.1-p7 | 12.1-p7.x |
| freebsd / freebsd | 12.1-p9 | 12.1-p9.x |
| freebsd / freebsd | 12.1-p8 | 12.1-p8.x |
| freebsd / freebsd | 11.4-p3 | 11.4-p3.x |
| freebsd / freebsd | 11.4-p2 | 11.4-p2.x |
| freebsd / freebsd | 11.3-p13 | 11.3-p13.x |
| freebsd / freebsd | 11.3-p12 | 11.3-p12.x |
| omniosce / omnios | - | r151034.x |
| openindiana / openindiana | - | hipster_2020.04.x |