CVE-2021-32847: moby hyperkit Out-of-bounds Read

Vulnerability summary

CVE-2021-32847 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in moby hyperkit. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.3% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 20-02-2023
   PublishedVulnerability first disclosed.
2. 10-03-2025
   Last modifiedVulnerability information updated.

Description

HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malicious guest can trigger a vulnerability in the host by abusing the disk driver that may lead to the disclosure of the host memory into the virtualized guest. This issue is fixed in commit cf60095a4d8c3cb2e182a14415467afd356e982f.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.