PT-2023-12179 · Hyperkit · Hyperkit

Agustin Gianni · Published 2023-02-17 · Updated 2023-06-26 · CVE-2021-32845

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HyperKit versions 0.20210107 and prior

Description HyperKit is a toolkit for embedding hypervisor capabilities in an application. The implementation of qnotify at pci vtrnd notify fails to check the return value of vq getchain, leading to struct iovec iov; being uninitialized and used to read memory in len = (int) read(sc->vrsc fd, iov.iov base, iov.iov len); when an attacker is able to make vq getchain fail. This issue may lead to a guest crashing the host, causing a denial of service, and under certain circumstances, memory corruption.

Recommendations For HyperKit versions 0.20210107 and prior, update to a version that includes the fix from commit 41272a980197917df8e58ff90642d14dec8fe948 to resolve the issue. As a temporary workaround, consider restricting access to the pci vtrnd notify function to minimize the risk of exploitation. Additionally, avoid using the vq getchain function in a way that could cause it to fail, as this could lead to the uninitialized struct iovec iov; being used.

Fix

Use of Uninitialized Resource

Unchecked Return Value

Weakness Enumeration

CWE-908

CWE-252

Related Identifiers

CVE-2021-32845

Affected Products

Hyperkit

References · 7

• https://github.com/moby/hyperkit/pull/313 · Patch
• https://github.com/moby/hyperkit/commit/41272a980197917df8e58ff90642d14dec8fe948 · Patch
• https://osv.dev/vulnerability/CVE-2021-32845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32845 · Security Note
• https://t.me/cibsecurity/58498 · Telegram Post
• https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit · Note
• https://t.me/cvenotify/44622 · Telegram Post