CVE-2017-6386: Medium severity Virglrenderer Project Virglrenderer vulnerability
Memory leak in the vrendcreatevertexelementsstate function in vrendrenderer.c in virglrenderer allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGLOBJECTVERTEXELEMENTS commands.
Other sources
Virgil 3d project, used by Quick Emulator(Qemu) to implement 3D GPU support for the virtio GPU, is vulnerable to memory leakage issue. It could occur when a guest tries to create vertex elements via 'VIRGLOBJECTVERTEXELEMENTS' command.
A guest user/process could use this flaw to leak host memory resulting in DoS.
Upstream patch: --------------- -> https://cgit.freedesktop.org/virglrenderer/commit/?id=737c3350850ca4dbc5633b3bdb4118176ce59920
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/03/01/7
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6386?
CVE-2017-6386 is classified as a high severity vulnerability due to its potential for causing denial of service through excessive memory consumption.
How do I fix CVE-2017-6386?
To fix CVE-2017-6386, update the virglrenderer software to version 0.8.0 or later.
Who can exploit CVE-2017-6386?
CVE-2017-6386 can be exploited by local guest OS users to trigger a denial of service.
What causes CVE-2017-6386?
CVE-2017-6386 is caused by a memory leak in the vrend_create_vertex_elements_state function when processing a large number of VIRGL_OBJECT_VERTEX_ELEMENTS commands.
What is affected by CVE-2017-6386?
CVE-2017-6386 affects the virglrenderer software used by the Quick Emulator (QEMU) to provide graphics acceleration.