CVE-2017-5994: Buffer Overflow
Heap-based buffer overflow in the vrendcreatevertexelementsstate function in vrendrenderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and crash) via the numelements parameter.
Other sources
Virgil 3d project, used by Quick Emulator(Qemu) to implement 3D GPU support for the virtio GPU, is vulnerable to an OOB array access issue. It could occur when creating vertex elements array in vrendcreatevertexelementsstate().
A guest user/process could use this flaw to crash the Qemu process instance resulting DoS.
Upstream patch: --------------- -> https://cgit.freedesktop.org/virglrenderer/commit/?id=114688c526fe45f341d75ccd1d85473c3b08f7a7
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/02/15/8
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
virglrendererto a version that resolves this vulnerability.Fixed in 0.6.0Patch 114688c526fe45f341d75ccd1d85473c3b08f7a7 - Compensating control
If possible, restrict/limit untrusted guest OS access to Qemu instances that use virtio GPU/virglrenderer, since the flaw can be triggered by a local guest user/process to crash the Qemu process (DoS).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5994?
CVE-2017-5994 is considered a critical vulnerability due to its potential to cause denial of service through a heap-based buffer overflow.
How does CVE-2017-5994 affect software?
CVE-2017-5994 allows local guest OS users to exploit the heap-based buffer overflow in virglrenderer prior to version 0.6.0, leading to crashes.
How do I fix CVE-2017-5994?
To fix CVE-2017-5994, update virglrenderer to version 0.6.0 or later.
Who are the affected users of CVE-2017-5994?
CVE-2017-5994 affects local users of guest operating systems running vulnerable versions of virglrenderer.
What can be done to mitigate CVE-2017-5994 risks?
Mitigation of CVE-2017-5994 can be achieved by restricting access to untrusted users and ensuring that the latest updates are applied.