bhyve's guest-to-host escapes cluster in its device models, the same categories as other hypervisors because the problem is identical, parsing guest-controlled device structures in the host process:
- virtio family: virtqueue descriptor and per-device header handling across virtio-blk/net/9p/console, bhyve's primary surface given its virtio focus.
- AHCI: command-list and PRD handling with guest-controlled DMA addresses and counts.
- e1000: transmit/descriptor and offload handling.
- XHCI (USB): ring and device-context handling.
Using the pattern#
# fingerprint the FreeBSD/bhyve version (maps to the FreeBSD advisory)
uname -r 2>/dev/null; freebsd-version 2>/dev/null
# from the guest, confirm which device models are present
pciconf -lv 2>/dev/null | grep -iE 'virtio|ahci|e1000|xhci'
Fingerprint the FreeBSD/bhyve version, confirm which device models the VM uses, and match to the FreeBSD security advisory for that device. The mechanisms mirror the QEMU device models, so that analysis transfers directly; escapes are version-specific and land in the userspace bhyve process.
Exploitation notes#
- Treat bhyve device escapes like QEMU's: the virtqueue, AHCI PRD, e1000 descriptor, and XHCI ring bug classes and mechanisms carry over from the QEMU guest-to-host escape pages.
- bhyve's smaller device set narrows the surface compared to QEMU or VirtualBox, concentrating attention on virtio and AHCI.
- FreeBSD advisories are the authoritative source for bhyve bugs; the mechanisms are on the guest-to-host escape page.