Vulnerabilities > CVE-2021-32843 - NULL Pointer Dereference vulnerability in Mobyproject Hyperkit

CVSS 5.5 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

local

low complexity

mobyproject

CWE-476

NVD

Published: 2023-02-17

Updated: 2023-02-28

Summary

HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has is a call to `vc_cfgread` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit df0e46c7dbfd81a957d85e449ba41b52f6f7beb4.

Vulnerable Configurations

Part	Description	Count
Application	Mobyproject Mobyproject Hyperkit - Mobyproject Hyperkit 0.20170214 Mobyproject Hyperkit 0.20170227 Mobyproject Hyperkit 0.20170425 Mobyproject Hyperkit 0.20170511 Mobyproject Hyperkit 0.20170519 Mobyproject Hyperkit 0.20170904 Mobyproject Hyperkit 0.20171020 Mobyproject Hyperkit 0.20171204 Mobyproject Hyperkit 0.20180123 Mobyproject Hyperkit 0.20180223 Mobyproject Hyperkit 0.20180403 Mobyproject Hyperkit 0.20180621 Mobyproject Hyperkit 0.20190201 Mobyproject Hyperkit 0.20190802 Mobyproject Hyperkit 0.20200224 Mobyproject Hyperkit 0.20200908 Mobyproject Hyperkit 0.20210107	18

Common Weakness Enumeration (CWE)

CWE-476 - NULL Pointer Dereference

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References