CVE-2021-32846: GHSL-2021-054_057: Code execution outside the virtualized guest in hyperkit - CVE-2021-32843, CVE-2021-32844, CVE-2021-32845, CVE-2021-32846
A malicious guest can trigger vulnerabilities in the host by abusing certain drivers that may lead to code execution outside the virtualized guest.
Other sources
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function pcivtsockproctx in virtio-sock can lead to to uninitialized memory use. In this situation, there is a check for the return value to be less or equal to VTSOCKMAXSEGS, but that check is not sufficient because the function can return -1 if it finds an error it cannot recover from. Moreover, the negative return value will be used by iovecpull in a while condition that can further lead to more corruption because the function is not designed to handle a negative iovlen. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit af5eba2360a7351c08dfd9767d9be863a50ebaba.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2021-32846.
What is the severity level of CVE-2021-32846?
The severity level of CVE-2021-32846 is high with a CVSS score of 7.8.
How does CVE-2021-32846 affect HyperKit?
CVE-2021-32846 affects HyperKit version 0.20210107.
What is the description of CVE-2021-32846?
CVE-2021-32846 is a vulnerability in HyperKit where the `pci_vtsock_proc_tx` function in `virtio-sock` can lead to uninitialized memory use.
How can I fix CVE-2021-32846?
To fix CVE-2021-32846, update HyperKit to a version higher than 0.20210107.