CVE-2019-18389: Buffer Overflow
A heap-based buffer overflow in the vrendrenderertransferwriteiov function in vrendrenderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGLCCMDRESOURCEINLINEWRITE commands.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-18389?
CVE-2019-18389 is a vulnerability in the vrend_renderer_transfer_write_iov function in virglrenderer through 0.8.0 that allows guest OS users to cause a denial of service or QEMU guest-to-host escape and code execution.
How does CVE-2019-18389 impact the affected software?
CVE-2019-18389 can result in a denial of service (DoS) or allow guest OS users to escape the QEMU host and execute arbitrary code.
Which software versions are affected by CVE-2019-18389?
Versions up to and including 0.8.0 of virglrenderer, openSUSE Leap 15.1, Redhat Enterprise Linux 8.0, and Debian Debian Linux 10.0 are affected.
What is the severity of CVE-2019-18389?
CVE-2019-18389 has a severity rating of 7.8 (high).
How can I mitigate the vulnerability in CVE-2019-18389?
To mitigate CVE-2019-18389, it is recommended to update to a version of virglrenderer beyond 0.8.0, if available, or apply the relevant security patches provided by the software vendors.