Security readout for executives and security teams
Plain-English summary
A malicious or faulty guest workload can trigger a bug in Moby HyperKit’s virtio-sock handling that may crash the host and may corrupt memory. The known affected version is 0.20210107. This is operationally serious for systems using HyperKit to run virtualized workloads.
Executive priority
Treat as high priority for systems that rely on HyperKit for isolation or business-critical virtualized workloads. The main business risk is host outage, with possible integrity impact from memory corruption. Patch or replace affected builds before accepting untrusted guest activity.
Technical view
In pci_vtsock_proc_tx, an error return of -1 can bypass an insufficient VTSOCK_MAXSEGS check and flow into iovec_pull, which is not designed for negative iov_len handling. The reported impact is guest-to-host denial of service and possible memory corruption. The issue is fixed by commit af5eba2360a7351c08dfd9767d9be863a50ebaba.
Likely exposure
Exposure is limited to deployments running Moby HyperKit 0.20210107 or downstream software bundling that vulnerable code. The most relevant risk is where untrusted, semi-trusted, or compromised guest workloads can interact with virtio-sock paths.
Exploitation context
The source bundle does not show CISA KEV listing or public active exploitation evidence. The vulnerability is local to the virtualization boundary: a guest can affect the host, with low attack complexity and no user interaction according to CVSS.
Researcher notes
The core issue is unchecked negative error propagation from pci_vtsock_proc_tx into iovec handling. Sources name CWE-908 and CVSS 7.7. Evidence supports denial of service and possible memory corruption, but does not establish reliable code execution or active exploitation.
Mitigation direction
- Upgrade to a HyperKit build containing commit af5eba2360a7351c08dfd9767d9be863a50ebaba.
- Check downstream vendor guidance if HyperKit is bundled inside another product.
- Avoid running untrusted guest workloads on affected HyperKit builds.
- Prioritize hosts where guest compromise would affect production availability or integrity.
Validation and detection
- Inventory HyperKit versions and identify any 0.20210107 installations.
- Verify the fixed commit or equivalent vendor patch is present.
- Map which systems allow untrusted or externally influenced guest workloads.
- Review host crash reports for HyperKit-related failures before patching.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-908: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-32846 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H2.55.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.7HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Uninitialized Resource
Use of Uninitialized Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.