Out-of-bounds Read in Moby Hyperkit
CVE-2021-32847
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malicious guest can trigger a vulnerability in the host by abusing the disk driver that may lead to the disclosure of the host memory into the virtualized guest. This issue is fixed in commit cf60095a4d8c3cb2e182a14415467afd356e982f.
Vulnerability class: Buffer Overflow
EPSS: 0.004 (29.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Moby Hyperkit — versions 0.20210107
- Mobyproject Hyperkit
Weakness classification (CWE)
References
- security-advisories@github.com (Exploit, Third Party Advisory)
- security-advisories@github.com (Product, Exploit)
- security-advisories@github.com (Patch)
Frequently asked questions
- What is CVE-2021-32847?
- CVE-2021-32847 is a high-severity vulnerability in Moby Hyperkit, classified under Out-of-bounds Read. CVSS score: 7.1/10. Published 2023-02-20.
- How severe is CVE-2021-32847?
- High severity. CVSS v3 base score is 7.1 out of 10.