CVE-2022-36660: 
NixOS vulnerability analysis and mitigation

xhyve commit dfbe09b contains a stack buffer overflow vulnerability in the pci_vtrnd_notify() component (GitHub Blog). The vulnerability was discovered in July 2022 and affects the pci_virtio_rnd device emulation functionality.

The vulnerability exists in the pci_vtrnd_notify() handler function where the return value of vq_getchain() is not properly checked. This leads to the iov stack variable remaining uninitialized, and iov.iov_base being used as the buffer to store random data read from sc->vrsc_fd without proper bounds checking (GitHub Blog).

If successfully exploited, an attacker could potentially achieve an out-of-bounds read/write primitive by manipulating the stack to leave an address of a buffer length as iov.iov_base. Since the data from sc->vrsc_fd is typically large, this could allow overwriting the length with a larger value (GitHub Blog).

While theoretically exploitable, practical exploitation may be challenging due to the shallow stack position of the iov variable, which tends to be overwritten before pci_vtrnd_notify() is reached (GitHub Blog).

As a temporary workaround until a patch is available, users can remove the pci_virtio_rnd device from their VM configuration to prevent exploitation (GitHub Blog).