PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-1889 Freebsd CVE debrief

CVE-2016-1889 is a high-severity FreeBSD bhyve issue that can let a local attacker escalate privileges on affected hosts. The supplied NVD record ties the flaw to an integer overflow in the bhyve hypervisor when configured with a large amount of guest memory.

Vendor
Freebsd
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

FreeBSD administrators and virtualization operators running bhyve on affected releases (10.1, 10.2, 10.3, and 11.0), especially where guest workloads are not fully trusted.

Technical summary

The supplied NVD data describes an integer overflow in bhyve on FreeBSD 10.1, 10.2, 10.3, and 11.0 when large guest memory is configured. NVD states this can enable local privilege escalation via a crafted device descriptor. The record maps the weakness to CWE-190 and assigns CVSS 3.0 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8).

Defensive priority

High. Prioritize remediation on any FreeBSD host using bhyve, because the flaw can enable local privilege escalation on the virtualization host.

Recommended defensive actions

  • Review the FreeBSD vendor advisory and NVD record for the fixed releases and official mitigation guidance.
  • Apply the FreeBSD updates or patches that address FreeBSD-SA-16:38.bhyve on affected systems.
  • Limit access to bhyve administration and reduce the number of users who can interact with virtualization management tooling.
  • Inventory FreeBSD 10.1-11.0 hosts to confirm whether bhyve is enabled and whether large guest memory allocations are in use.
  • Verify patch management and monitoring coverage for all bhyve-enabled FreeBSD systems.

Evidence notes

The supplied NVD record marks FreeBSD 10.1, 10.2, 10.3, and 11.0 as vulnerable, identifies CWE-190, and links to the FreeBSD vendor advisory FreeBSD-SA-16:38.bhyve.asc. The provided enrichment data does not list this CVE in KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-1889 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-1889

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-1889 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-1889

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.