HyperKit 0.20210107 virtio-sock pci_vtsock_proc_tx uninitialized resource

Summaryinfo

A vulnerability categorized as critical has been discovered in HyperKit 0.20210107. The impacted element is the function pci_vtsock_proc_tx of the component virtio-sock. Executing a manipulation can lead to uninitialized resource. The identification of this vulnerability is CVE-2021-32846. The attack can only be executed locally. There is no exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability has been found in HyperKit 0.20210107 and classified as critical. This vulnerability affects the function pci_vtsock_proc_tx of the component virtio-sock. The manipulation with an unknown input leads to a uninitialized resource vulnerability. The CWE definition for the vulnerability is CWE-908. The product uses or accesses a resource that has not been initialized. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead to to uninitialized memory use. In this situation, there is a check for the return value to be less or equal to `VTSOCK_MAXSEGS`, but that check is not sufficient because the function can return `-1` if it finds an error it cannot recover from. Moreover, the negative return value will be used by `iovec_pull` in a while condition that can further lead to more corruption because the function is not designed to handle a negative `iov_len`. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit af5eba2360a7351c08dfd9767d9be863a50ebaba.

The weakness was shared 02/18/2023 as GHSL-2021-054. The advisory is shared for download at securitylab.github.com. This vulnerability was named CVE-2021-32846 since 05/12/2021. There are known technical details, but no exploit is available.

Applying the patch af5eba2360a7351c08dfd9767d9be863a50ebaba is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• HyperKit

Version

• 0.20210107

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion