CVE-2021-32847: Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx
First published: Mon Feb 20 2023(Updated: )
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malicious guest can trigger a vulnerability in the host by abusing the disk driver that may lead to the disclosure of the host memory into the virtualized guest. This issue is fixed in commit cf60095a4d8c3cb2e182a14415467afd356e982f.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mobyproject Hyperkit | <=0.20210107 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-32847?
CVE-2021-32847 is a vulnerability in HyperKit, a toolkit for embedding hypervisor capabilities in an application.
What is the severity of CVE-2021-32847?
The severity of CVE-2021-32847 is high with a CVSS score of 6.5.
How does CVE-2021-32847 affect HyperKit?
In versions 0.20210107 and prior, a malicious guest can trigger a vulnerability in the host by abusing the disk driver, potentially leading to the disclosure of host memory into the virtualized guest.
How can I fix CVE-2021-32847 in HyperKit?
The issue is fixed in a later version of HyperKit, so it is recommended to update to the latest version to mitigate the vulnerability.
Where can I find more information about CVE-2021-32847?
You can find more information about CVE-2021-32847 in the references provided: [GitHub Commit](https://github.com/moby/hyperkit/commit/cf60095a4d8c3cb2e182a14415467afd356e982f), [GitHub Source](https://github.com/moby/hyperkit/blob/2f061e447e1435cdf1b9eda364cea6414f2c606b/src/lib/pci_virtio_block.c#L316), [GitHub Security Advisory](https://securitylab.github.com/advisories/GHSL-2021-058-moby-hyperkit/)
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/references
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/title
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/mobyproject
- canonical/mobyproject hyperkit
- version/mobyproject hyperkit/0.20210107