CVE-2021-32845: Use of Uninitialized Resource

HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of qnotify at pcivtrndnotify fails to check the return value of vqgetchain. This leads to struct iovec iov; being uninitialized and used to read memory i...

CVE-2021-32845

HyperKit versions 0.20210107 and earlier are affected by a vulnerability in pci_vtrnd_notify where the return value of vq_getchain is not checked. This can result in an uninitialized struct iovec (iov) being used to read memory, potentially causing a guest to crash the host and enable memory corr...