CVE-2021-32845

Katalog CVE

CVSS 7.8 · High EPSS 0,25%

Kerentanan Use of Uninitialized Resource pada mobyproject hyperkit. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948.

Rincian

Terbit di NVD

17 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-908: Use of Uninitialized Resource
CWE-252: Unchecked Return Value

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/moby/hyperkit/commit/41272a980197917df8e58ff90642d14dec8fe948 patch
• https://github.com/moby/hyperkit/pull/313 patch
• https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/ advisory pihak ketiga