CVE-2021-32845
📋 TL;DR
This vulnerability in HyperKit allows a malicious guest virtual machine to crash the host system, causing denial of service. Under certain conditions, it may also lead to memory corruption. Anyone using HyperKit versions 0.20210107 and earlier is affected.
💻 Affected Systems
- moby/hyperkit
📦 What is this software?
Hyperkit by Mobyproject
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to potential host compromise or data integrity issues
Likely Case
Host system crash causing denial of service to all VMs
If Mitigated
Limited to denial of service if proper isolation controls are in place
🎯 Exploit Status
Requires attacker to control a guest VM and trigger specific conditions
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 41272a980197917df8e58ff90642d14dec8fe948 and later
Vendor Advisory: https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/
Restart Required: Yes
Instructions:
1. Update HyperKit to commit 41272a980197917df8e58ff90642d14dec8fe948 or later
2. Rebuild from source or use updated package
3. Restart all affected virtualization services
🔧 Temporary Workarounds
Disable virtio-rnd device
allRemove or disable the virtio-rnd device that triggers the vulnerable code path
Modify HyperKit configuration to remove '-s 0,virtio-rnd' or equivalent virtio-rnd device
🧯 If You Can't Patch
- Isolate HyperKit hosts from critical production systems
- Implement strict access controls for guest VM creation and management
🔍 How to Verify
Check if Vulnerable:
Check HyperKit version: hyperkit --version should show version <= 0.20210107Check Version:
hyperkit --versionVerify Fix Applied:
Verify commit hash includes 41272a980197917df8e58ff90642d14dec8fe948 or version > 0.20210107📡 Detection & Monitoring
Log Indicators:
- Host system crashes
- HyperKit process termination
- Kernel panic logs related to virtualization
Network Indicators:
- Unusual VM-to-host communication patterns
SIEM Query:
process:hyperkit AND (event:crash OR event:termination)🔗 References
- https://github.com/moby/hyperkit/commit/41272a980197917df8e58ff90642d14dec8fe948
- https://github.com/moby/hyperkit/pull/313
- https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/
- https://github.com/moby/hyperkit/commit/41272a980197917df8e58ff90642d14dec8fe948
- https://github.com/moby/hyperkit/pull/313
- https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/
