CVE-2021-32614: 
NixOS vulnerability analysis and mitigation

A buffer overflow vulnerability was identified in dmg2img through version 20170502. The vulnerability exists in the fill_mishblk() function which performs an unchecked memcpy operation of 0xCC bytes without validating the buffer length (Debian Tracker).

The vulnerability stems from the fill_mishblk() function which does not verify the length of the read buffer before performing a memcpy operation of 0xCC (204) bytes. Since the length of the buffer is attacker-controlled, providing a length smaller than 0xCC causes memcpy to read beyond the allocated buffer bounds (RedHat Bugzilla).

This vulnerability could potentially lead to memory layout information leakage through the exposed data. The leaked information could potentially be used as part of a chain of vulnerabilities to achieve code execution (RedHat Bugzilla).

The vulnerability requires an attacker to provide specially crafted input with a buffer length smaller than 204 bytes to trigger the out-of-bounds read condition (RedHat Bugzilla).

The vulnerability affects multiple Debian releases including bullseye, bookworm, trixie, and sid, all of which remain vulnerable to this issue (Debian Tracker).