CVE-2022-36660: 
NixOS vulnerability analysis and mitigation

xhyve commit dfbe09b contains a stack buffer overflow vulnerability in the pcivtrndnotify() component (GitHub Blog). The vulnerability was discovered in July 2022 and affects the pcivirtiornd device emulation functionality.

The vulnerability exists in the pcivtrndnotify() handler function where the return value of vqgetchain() is not properly checked. This leads to the iov stack variable remaining uninitialized, and iov.iovbase being used as the buffer to store random data read from sc->vrsc_fd without proper bounds checking (GitHub Blog).

If successfully exploited, an attacker could potentially achieve an out-of-bounds read/write primitive by manipulating the stack to leave an address of a buffer length as iov.iovbase. Since the data from sc->vrscfd is typically large, this could allow overwriting the length with a larger value (GitHub Blog).

As a temporary workaround until a patch is available, users can remove the pcivirtiornd device from their VM configuration to prevent exploitation (GitHub Blog).