CVE-2017-5937: Null Pointer Dereference
The utilformatispureuint function in vrendrenderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGLCCMDCLEAR command.
Other sources
Virgil 3d project, used by Quick Emulator(Qemu) to implement 3D GPU support for the virtio GPU, is vulnerable to a null pointer dereference issue. It could occur when a guest invokes a virgl 'VIRGLCCMDCLEAR' command.
A guest user/process could use this flaw to crash Qemu process resulting in DoS.
Upstream patch: --------------- -> https://cgit.freedesktop.org/virglrenderer/commit/?id=48f67f60967f963b698ec8df57ec6912a43d6282
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/02/08/5
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
virglrenderer (Virgil 3D project) / Qemu virtio GPU 3D supportto a version that resolves this vulnerability.Fixed in 0.6.0Patch 48f67f60967f963b698ec8df57ec6912a43d6282 - Compensating control
Mitigate the DoS risk by restricting or isolating guest access so that untrusted local guest OS users/processes cannot invoke the virgl 'VIRGL_CCMD_CLEAR' command that targets the vulnerable virtio GPU 3D support.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5937?
CVE-2017-5937 is classified as a denial of service vulnerability due to a NULL pointer dereference.
How do I fix CVE-2017-5937?
To fix CVE-2017-5937, upgrade to virglrenderer version 0.6.0 or later.
What causes CVE-2017-5937?
CVE-2017-5937 is caused by a crafted VIRGL_CCMD_CLEAR command that triggers a NULL pointer dereference in the vrend_renderer.c code.
Who is affected by CVE-2017-5937?
CVE-2017-5937 affects local guest OS users of virglrenderer version 0.5.0 and earlier.
What software is involved in CVE-2017-5937?
CVE-2017-5937 involves the Virgil 3D project, specifically the virglrenderer component used by QEMU.