CVE-2019-18391

CVE-2019-18391 is a heap-based buffer overflow in virglrenderer’s vrend_renderer_transfer_write_iov (virglrenderer up to 0.8.0) that allows a local attacker (guest OS) to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands. Several connected advisories reference this flaw and ...

CVE-2022-0135

CVE-2022-0135 affects the VirGL virtual OpenGL renderer (virglrenderer). A crafted virgil resource can trigger an out-of-bounds write via the VIRTGPU_EXECBUFFER ioctl, leading to denial of service or possible code execution in the guest. Connected advisories confirm the issue and note that patche...

CVE-2019-18390

CVE-2019-18390 concerns virglrenderer with an out-of-bounds read in vrend_blit_need_swizzle (vrend_renderer.c) affecting versions up to 0.8.0. The vulnerability enables a DoS from a guest OS via VIRGL_CCMD_BLIT commands, with local attack vector and partial confidentiality/availability impact per...

CVE-2019-18388

CVE-2019-18388 affects virglrenderer, with a NULL pointer dereference in vrend_renderer.c up to version 0.8.0. The flaw allows a local guest OS user to trigger a denial of service via malformed VRAM commands. Multiple connected advisories (Debian DLA-3232, openSUSE SUSE-SU updates, SUSE openSUSE-...

CVE-2019-18389

CVE-2019-18389 describes a heap-based buffer overflow in the virglrenderer transfer path. Specifically, vrend_renderer_transfer_write_iov in vrend_renderer.c (virglrenderer up to version 0.8.0) can be triggered by VIRGL_CCMD_RESOURCE_INLINE_WRITE, enabling denial of service and potentially guest‑...

CVE-2022-0175

CVE-2022-0175 affects virglrenderer (VirGL virtual OpenGL renderer). A flaw in how memory is initialized for host-backed resources allows a malicious guest to mmap the guest kernel and read uninitialized host memory, potentially leaking information. Impact is information disclosure; attack vector...

CVE-2020-8002

The CVE-2020-8002 entry concerns virglrenderer’s vrend_renderer.c: a NULL pointer dereference in versions up to 0.8.1 can allow a denial of service when a grid is launched without a Compute Shader. The issue is repeatedly reported across connected advisories (Debian DLA/Debian LTS, Alpine Linux, ...

CVE-2020-8003

CVE-2020-8003 applies to virglrenderer, specifically a double-free in vrend_renderer.c that can cause a denial of service when a texture allocation fails. The root cause is that vrend_renderer_resource_allocated_texture is not an appropriate place for a free. Public documentation in the connected...

CVE-2016-10163

CVE-2016-10163 affects virglrenderer: memory leak in vrend_renderer_context_create_internal (vrend_decode.c) prior to 0.6.0. Local guest OS users can cause host memory exhaustion by repeatedly creating a decode context, leading to a denial of service. Remediation: upgrade virglrenderer to 0.6.0 o...

CVE-2017-5994

CVE-2017-5994 : Heap-based buffer overflow in virglrenderer’s vrend_create_vertex_elements_state (vrend_renderer.c) affects versions before 0.6.0. Local guest OS users can trigger an out-of-bounds access leading to a denial of service. Mitigation: upgrade virglrenderer to 0.6.0 or newer (see open...

CVE-2017-5580

CVE-2017-5580 affects virglrenderer prior to version 0.6.0, where the parse_instruction path in tgsi_text.c can trigger an out-of-bounds access in a crafted texture instruction. This results in a denial-of-service via process crash, with local guest OS users as the exploit vector. Public document...

CVE-2017-5956

The CVE-2017-5956 issue affects virglrenderer’s vrend_draw_vbo function (pre-0.6.0). Local guest OS users can trigger a denial of service via out-of-bounds access involving vertext_buffer_index, potentially crashing the QEMU process. Public details consistently associate this with virglrenderer p...

CVE-2016-10214

CVE-2016-10214 concerns a memory leak in virgl_resource_attach_backing within virglrenderer prior to 0.6.0. The issue allows a local guest OS user to trigger memory consumption/DoS by issuing a large sequence of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands. Multiple advisories (openSUSE/SUSE G...

CVE-2017-5957

CVE-2017-5957 is a stack-based buffer overflow in the function vrend_decode_set_framebuffer_state() within virglrenderer (vrend_decode.c), used by Quick Emulator (QEMU). The overflow is triggered via the nr_cbufs argument, allowing a local guest user to crash the application (DoS). The descriptio...

CVE-2017-6317

CVE-2017-6317 affects virglrenderer. A memory leak in the add_shader_program path (vrend_renderer.c) prior to version 0.6.0 can cause host memory consumption and a local DoS. A fix is available in virglrenderer 0.6.0 and later; upgrades to this version are recommended where affected.

CVE-2017-5993

CVE-2017-5993 describes a memory leak in virglrenderer’s vrend_renderer_init_blit_ctx (vrend_blitter.c) prior to 0.6.0. A local attacker able to issue a high volume of VIRGL_CCMD_BLIT commands could cause host memory consumption leading to DoS. Connected sources (OSV entries and vendor advisories...

CVE-2017-6386

CVE-2017-6386 affects virglrenderer: memory leak in vrend_create_vertex_elements_state (vrend_renderer.c) can cause host memory exhaustion via a high volume of VIRGL_OBJECT_VERTEX_ELEMENTS from a local guestOS user, leading to DoS. The provided documents do not specify a patch version or remediat...

CVE-2017-6210

**CVE-2017-6210 affects virglrenderer (vrend_decode_reset in vrend_decode.c) with exploitation by local guest OS users. It allows a denial of service via a NULL pointer dereference, causing the QEMU process to crash when context 0 is destroyed, and is rated CVSSv3.0: 6.5 (MEDIUM) / CVSSv2.0: 2.1 ...

CVE-2017-5937

CVE-2017-5937 affects the Virgil 3D virglrenderer project (virglrenderer) up to and including version 0.6.0. The vulnerability is a NULL pointer dereference in vrend_renderer.c during handling of the VIRGL_CCMD_CLEAR command, leading to a local denial of service. Several connected records confirm...

CVE-2017-6209

CVE-2017-6209 affects virglrenderer (Gallium driver) before 0.6.0. The vulnerability is a stack-based buffer overflow in the parse_identifier function in tgsi_text.c within the TGSI auxiliary module, exploitable by local guest OS users to cause a denial of service via out-of-bounds access, potent...