CVE-2021-32844: GHSL-2021-054_057: Code execution outside the virtualized guest in hyperkit - CVE-2021-32843, CVE-2021-32844, CVE-2021-32845, CVE-2021-32846
A malicious guest can trigger vulnerabilities in the host by abusing certain drivers that may lead to code execution outside the virtualized guest.
Other sources
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, vipciwrite has is a call to vccfgwrite that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-32844?
CVE-2021-32844 is a vulnerability in HyperKit, a toolkit for embedding hypervisor capabilities in an application.
What is the severity of CVE-2021-32844?
CVE-2021-32844 has a severity rating of medium (5.5).
What is the affected software of CVE-2021-32844?
The affected software of CVE-2021-32844 is Mobyproject HyperKit version 0.20210107 and prior.
How can CVE-2021-32844 be exploited?
CVE-2021-32844 can be exploited by a guest crashing the host through a call to `vi_pci_write` that does not check for null in HyperKit.
Is there a fix for CVE-2021-32844?
Yes, a fix for CVE-2021-32844 is available. Users should update to a version of HyperKit that is later than 0.20210107.