CVE-2021-4158: 
NixOS vulnerability analysis and mitigation

A NULL pointer dereference vulnerability was discovered in the ACPI code of QEMU, identified as CVE-2021-4158. The vulnerability was found in the pci_write() function within hw/acpi/pcihp.c, where a bus pointer was used without proper validation. This vulnerability was reported on December 22, 2021, affecting QEMU systems (MITRE CVE, Red Hat Bugzilla).

The vulnerability stems from a NULL pointer dereference in the ACPI code where the bus pointer is used without verification in the pci_write() function. The issue was introduced in commit b32bd763 which added the 'acpi-index' property for PCI devices. The flaw occurs when an invalid selector is supplied, leading to the dereferencing of an unchecked NULL bus pointer (QEMU Commit, QEMU Issue).

When exploited, this vulnerability allows a malicious privileged user within the guest system to crash the QEMU process on the host, resulting in a denial of service condition. This impact affects the availability of the virtualization service (NVD, Ubuntu Security).

The vulnerability was patched with a fix that validates the hotplug selector on access. The fix was implemented by adding validation checks before using the bus pointer in the pci_write() function. The patch was committed to the QEMU codebase and distributed through various Linux distribution updates (QEMU Patch).