Debian 9821 Published by

A virglrenderer security update has been released for Debian GNU/Linux 10 LTS to address several security vulnerabilities.



DLA 3232-1: virglrenderer security update


-------------------------------------------------------------------------
Debian LTS Advisory DLA-3232-1 debian-lts@lists.debian.org
  https://www.debian.org/lts/security/ Tobias Frost
December 07, 2022   https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : virglrenderer
Version : 0.7.0-2+deb10u1
CVE ID : CVE-2019-18388 CVE-2019-18389 CVE-2019-18390 CVE-2019-18391
CVE-2020-8002 CVE-2020-8003 CVE-2022-0135
Debian Bug : 946942 949954 1009073

Several security vulnerabilities were discovered in virglrenderer, a virtual
GPU for KVM virtualization.

CVE-2019-18388

A NULL pointer dereference in vrend_renderer.c in virglrenderer through
0.8.0 allows guest OS users to cause a denial of service via malformed
commands.

CVE-2019-18389

A heap-based buffer overflow in the vrend_renderer_transfer_write_iov
function in vrend_renderer.c in virglrenderer through 0.8.0 allows
guest OS users to cause a denial of service, or QEMU guest-to-host
escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE
commands.

CVE-2019-18390

An out-of-bounds read in the vrend_blit_need_swizzle function in
vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS
users to cause a denial of service via VIRGL_CCMD_BLIT commands.

CVE-2019-18391

A heap-based buffer overflow in the vrend_renderer_transfer_write_iov
function in vrend_renderer.c in virglrenderer through 0.8.0 allows
guest OS users to cause a denial of service via
VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.

CVE-2020-8002

A NULL pointer dereference in vrend_renderer.c in virglrenderer through
0.8.1 allows attackers to cause a denial of service via commands that attempt
to launch a grid without previously providing a Compute Shader (CS).

CVE-2020-8003

A double-free vulnerability in vrend_renderer.c in virglrenderer through
0.8.1 allows attackers to cause a denial of service by triggering texture
allocation failure, because vrend_renderer_resource_allocated_texture is not an
appropriate place for a free.

CVE-2022-0135

An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer
(virglrenderer). This flaw allows a malicious guest to create a specially
crafted virgil resource and then issue a VIRTGPU_EXECBUFFER ioctl, leading to a
denial of service or possible code execution.

For Debian 10 buster, these problems have been fixed in version
0.7.0-2+deb10u1.

We recommend that you upgrade your virglrenderer packages.

For the detailed security status of virglrenderer please refer to
its security tracker page at:
  https://security-tracker.debian.org/tracker/virglrenderer

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at:   https://wiki.debian.org/LTS