CVE-2021-32845highCWE-908

CVE-2021-32845: falha de alta gravidade em moby hyperkit

Moby HyperKit uninitialized memory use vtrnd pci_vtrnd_notify

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar hyperkit

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.3%
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
moby · hyperkit
CVEs relacionadas — moby hyperkit

No mesmo produto, das mais perigosas para as menos.

CVE-2021-32847HIGHMoby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_txEPSS 0.4%CVE-2021-32846HIGHMoby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_txEPSS 0.3%CVE-2021-32844MEDIUMCVE-2021-32844EPSS 0.2%CVE-2021-32843MEDIUMCVE-2021-32843EPSS 0.2%