CVE-2021-32843: GHSL-2021-054_057: Code execution outside the virtualized guest in hyperkit - CVE-2021-32843, CVE-2021-32844, CVE-2021-32845, CVE-2021-32846
A malicious guest can trigger vulnerabilities in the host by abusing certain drivers that may lead to code execution outside the virtualized guest.
Other sources
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, virtio.c has is a call to vccfgread that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit df0e46c7dbfd81a957d85e449ba41b52f6f7beb4.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-32843?
CVE-2021-32843 is a vulnerability in HyperKit, a toolkit for embedding hypervisor capabilities in an application.
What is the severity of CVE-2021-32843?
The severity of CVE-2021-32843 is medium with a CVSS score of 5.5.
How does CVE-2021-32843 affect HyperKit?
CVE-2021-32843 affects HyperKit versions 0.20210107 and prior, potentially allowing a guest to crash the host and cause denial of service.
How can I fix CVE-2021-32843?
To fix CVE-2021-32843, update HyperKit to a version that includes the fix, such as the commit df0e46c7dbfd81a957d85e449ba41b52f6f7beb4 or the pull request 313 in the GitHub repository.
Are there any additional resources for CVE-2021-32843?
Yes, you can find more information about CVE-2021-32843 in the security advisory GHSL-2021-054_057-moby-hyperkit on the GitHub Security Lab website.