bhyve

bhyve is FreeBSD's type-2 hypervisor, using hardware virtualization with device models emulated in a userspace bhyve process. The guest-to-host escape targets those device models, virtio, AHCI, e1000, and the USB and framebuffer devices, with a flaw landing in the bhyve process on the host, alongside theft of the guest disk images.

1 min di letturaaggiornato il 7 ott 2026florianamette1 contributore
Chiedi al tuo assistente (MCP)Modifica su GitHub

bhyve is FreeBSD's native hypervisor. The vmm.ko kernel module provides CPU and memory virtualization using VT-x or AMD-V, while a per-VM userspace bhyve process emulates the devices. The design is lean and modern, with a focus on virtio and a small set of emulated devices (AHCI storage, the e1000 NIC, USB, a framebuffer, and PCI passthrough). A guest-to-host escape therefore targets the device models in the bhyve process, landing on the FreeBSD host, and the usual disk-image theft applies to the guest's backing storage.

bash
# on a FreeBSD bhyve host
kldstat | grep vmm; ls /dev/vmm/
ps aux | grep bhyve | grep -v grep

Subtopics#

References#

PrecedenteKnown escape exploitsSuccessiva Host access and shell