CVE-2021-32844: 
Homebrew vulnerability analysis and mitigation

CVE-2021-32844 affects hyperkit, a toolkit for embedding hypervisor capabilities. The vulnerability was discovered and reported by Agustin Gianni from the GitHub Security Lab on March 30, 2021, and was fixed on June 24, 2021. The issue involves a null pointer dereference in the vi_pci_write function when handling virtual device configuration writes (GitHub Security Lab).

The vulnerability exists in the virtio.c file where the vc_cfgwrite function pointer is called without checking for null. When a device like vtrnd (which is used to supply randomness to the guest) doesn't implement all available operations, calls to virtio handlers must be checked for null. The vulnerable code attempts to dereference the vc_cfgwrite function pointer without validation, leading to a crash in the host system (GitHub Security Lab).

This vulnerability allows a malicious guest to crash the host, causing a denial of service condition. The issue occurs when a guest triggers specific virtual device configuration writes that lead to a null pointer dereference (GitHub Security Lab).

The issue was fixed in commit 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13 by adding a null check before dereferencing the vc_cfgwrite function pointer. The fix is a backport of the solution implemented in bhyve (GitHub Commit).