CVE-2021-32422: 
NixOS vulnerability analysis and mitigation

CVE-2021-32422 affects dpic version 2021.01.01, which contains a global buffer overflow vulnerability in the yylex() function within main.c. The vulnerability was discovered and reported in 2021, allowing reads beyond the bounds of an array (GitLab Issue, NVD).

The vulnerability is a global buffer overflow that occurs in the yylex() function in main.c. The issue specifically involves reading out of bounds of the 'entrytv' array, which is defined as a global variable with a size of 512 bytes. When triggered, the vulnerability results in a READ operation of size 4 at an unauthorized memory location. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability affects the availability of the system by causing a buffer overflow condition. When exploited, it can lead to program crashes or potential denial of service conditions. The CVSS score indicates high severity impact on availability while confidentiality and integrity remain unaffected (NVD).

The vulnerability has been confirmed exploitable through a proof-of-concept test case. The issue was discovered through fuzzing with Hongfuzz, and a reproducer test case has been provided that triggers the buffer overflow condition. The exploit requires no special privileges or user interaction to execute (GitLab Issue).

A fix for this vulnerability was implemented in a subsequent commit that improved robustness to fuzzed input (GitLab Commit).