CVE-2021-32847
📋 TL;DR
CVE-2021-32847 is an out-of-bounds read vulnerability in HyperKit's virtio block driver that allows a malicious guest VM to read host memory. This can lead to sensitive information disclosure from the host to the guest. Affected users are those running HyperKit versions 0.20210107 and earlier with untrusted guest VMs.
💻 Affected Systems
- HyperKit
📦 What is this software?
Hyperkit by Mobyproject
⚠️ Risk & Real-World Impact
Worst Case
Complete disclosure of sensitive host memory contents including credentials, encryption keys, and other privileged data to a malicious guest VM.
Likely Case
Partial memory disclosure exposing host system information, potentially including sensitive data from other processes.
If Mitigated
No impact if patched or if only trusted guest VMs are used.
🎯 Exploit Status
Exploitation requires guest VM access and knowledge of the vulnerability; proof-of-concept details are publicly available in the GitHub advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit cf60095a4d8c3cb2e182a14415467afd356e982f and later
Vendor Advisory: https://securitylab.github.com/advisories/GHSL-2021-058-moby-hyperkit/
Restart Required: Yes
Instructions:
1. Update HyperKit to commit cf60095a4d8c3cb2e182a14415467afd356e982f or later. 2. Rebuild from source if using custom builds. 3. Restart all HyperKit instances and affected guest VMs.
🔧 Temporary Workarounds
Disable virtio block driver
allUse alternative storage drivers instead of the vulnerable virtio block driver
Configure HyperKit to use alternative storage backends (e.g., virtio-scsi, NVMe)
Isolate guest VMs
allRun only trusted guest VMs to prevent exploitation
Implement strict VM trust policies and access controls
🧯 If You Can't Patch
- Isolate HyperKit instances on separate network segments to limit lateral movement
- Implement strict monitoring of guest VM behavior and memory access patterns
🔍 How to Verify
Check if Vulnerable:
Check HyperKit version: hyperkit --version should show version 0.20210107 or earlierCheck Version:
hyperkit --versionVerify Fix Applied:
Verify HyperKit is built from commit cf60095a4d8c3cb2e182a14415467afd356e982f or later using git log📡 Detection & Monitoring
Log Indicators:
- Unusual memory access patterns from guest VMs
- Multiple failed virtio block operations
Network Indicators:
- Abnormal data exfiltration from host to guest VM
SIEM Query:
source="hyperkit" AND (event="memory_access" OR event="virtio_block_error")🔗 References
- https://github.com/moby/hyperkit/blob/2f061e447e1435cdf1b9eda364cea6414f2c606b/src/lib/pci_virtio_block.c#L316
- https://github.com/moby/hyperkit/commit/cf60095a4d8c3cb2e182a14415467afd356e982f
- https://securitylab.github.com/advisories/GHSL-2021-058-moby-hyperkit/
- https://github.com/moby/hyperkit/blob/2f061e447e1435cdf1b9eda364cea6414f2c606b/src/lib/pci_virtio_block.c#L316
- https://github.com/moby/hyperkit/commit/cf60095a4d8c3cb2e182a14415467afd356e982f
- https://securitylab.github.com/advisories/GHSL-2021-058-moby-hyperkit/
