Host crash via unchecked Virtio write handler
Published Feb 17, 2023 · Updated Mar 10, 2025
NULL pointer dereference in HyperKit 0.20210107 and earlier allows guest OS users to crash the host through a Virtio RNG PCI write. The vi_pci_write function invokes the vtrnd device's absent vc_cfgwrite handler without checking it for NULL, transferring control to address zero. Reaching the flaw requires control of a guest configured with virtio-rnd; exploitation terminates the host hypervisor and interrupts its guests.
Summary
What happened
NULL pointer dereference in HyperKit 0.20210107 and earlier allows guest OS users to crash the host through a Virtio RNG PCI write. The vi_pci_write function invokes the vtrnd device's absent vc_cfgwrite handler without checking it for NULL, transferring control to address zero. Reaching the flaw requires control of a guest configured with virtio-rnd; exploitation terminates the host hypervisor and interrupts its guests.
The record
- CVE
- CVE-2021-32844
- Published
- Feb 17, 2023
- Updated
- Mar 10, 2025
- Vendor
- Moby Project
- Product
- HyperKit
- Classifications
- CWE-476, T1499.004
- Attack vector
- local
- Privileges
- unauthenticated
Timeline
How it unfolded
- Feb 17, 2023CVE publishedPublication date reported by the CVE source.
- Mar 10, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=0.20210107 <=0.20210107
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- Multiboot guest crash proof of conceptproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo