CVE-2021-32843: 
Homebrew vulnerability analysis and mitigation

HyperKit, a toolkit for embedding hypervisor capabilities in applications, was found to contain a vulnerability in versions 0.20210107 and prior. The vulnerability (CVE-2021-32843) involves a null pointer dereference in the vc_cfgread function pointer within virtio.c, which could be triggered by a malicious guest operating system (GitHub Security Lab).

The vulnerability exists in the vi_pci_read function where there is a call to vc_cfgread that does not check for null. The function pointer vc_cfgread is used to read the virtio configuration of a device, which is an operation that the guest performs to initialize the virtio drivers. Not every device implements all available operations, and one such device is vtrnd which is used to supply randomness to the guest. The vulnerability occurs when this unchecked null pointer is dereferenced (GitHub Security Lab).

When exploited, this vulnerability allows a malicious guest to trigger a crash of the host system, resulting in a denial of service condition. The crash occurs due to the null pointer dereference when attempting to access the unimplemented function (GitHub Security Lab).

The issue has been fixed by adding a null check before calling the vc_cfgread function pointer, similar to what is implemented in bhyve. The fix was merged into the main repository through pull request #313 (GitHub PR).