CVE-2017-6317: Medium severity Virglrenderer Project Virglrenderer vulnerability
Memory leak in the addshaderprogram function in vrendrenderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) via vectors involving the sprog variable.
Other sources
Virgil 3d project, used by Quick Emulator(Qemu) to implement 3D GPU support for the virtio GPU, is vulnerable to a memory leakageissue. It could occur while in addshaderprogram().
A guest user/process could use this flaw to leak host memory resulting in DoS.
Upstream patch: --------------- -> https://cgit.freedesktop.org/virglrenderer/commit/?id=a2f12a1b0f95b13b6f8dc3d05d7b74b4386394e4
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/02/24/5
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
virglrendererto a version that resolves this vulnerability.Fixed in 0.6.0 - Compensating control
Mitigate locally exploitable memory leak in virglrenderer (used by Qemu for virtio GPU 3D support) by restricting use of the affected 3D/GPU acceleration feature to trusted guests/users, or disable virtio GPU 3D (virglrenderer) support if not required.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6317?
CVE-2017-6317 has a high severity rating due to the potential denial of service from host memory consumption.
How do I fix CVE-2017-6317?
To mitigate CVE-2017-6317, it is recommended to upgrade Virglrenderer to version 0.6.0 or later.
What causes the vulnerability in CVE-2017-6317?
CVE-2017-6317 is caused by a memory leak in the add_shader_program function within virend_renderer.c.
Who is affected by CVE-2017-6317?
Local guest OS users running vulnerable versions of Virglrenderer prior to 0.6.0 are affected by CVE-2017-6317.
What software is mainly impacted by CVE-2017-6317?
CVE-2017-6317 primarily impacts the Freedesktop Virglrenderer software used in conjunction with Quick Emulator (Qemu) for 3D GPU support.