CVE-2022-0175
First published: Mon Jan 10 2022(Updated: )
A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/virglrenderer | 0.8.2-5+deb11u1 0.10.4-1 1.0.0-1 | |
| Freedesktop Virglrenderer | =0.9.0 | |
| Freedesktop Virglrenderer | =0.9.1 | |
| Red Hat Enterprise Linux | =8.0 |
Remedy
https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2022-0175
- https://bugzilla.redhat.com/show_bug.cgi?id=2039003
- https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c
- https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654
- https://security-tracker.debian.org/tracker/CVE-2022-0175
- https://security.gentoo.org/glsa/202210-05
- https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/7899e057327848300b18d8f03aa3789e00ed0221
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2039343
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2039342
Frequently Asked Questions
What is CVE-2022-0175?
CVE-2022-0175 is a vulnerability found in the VirGL virtual OpenGL renderer (virglrenderer) that allows a malicious guest to read uninitialized memory from the host.
What is the severity of CVE-2022-0175?
The severity of CVE-2022-0175 is medium with a CVSS score of 5.5.
How does CVE-2022-0175 affect the Virglrenderer software?
CVE-2022-0175 affects Virglrenderer versions 0.9.0 and 0.9.1.
How can I fix CVE-2022-0175 in Virglrenderer?
To fix CVE-2022-0175 in Virglrenderer, update to version 0.10.4-1 or higher.
Are there any references for CVE-2022-0175?
Yes, you can find references for CVE-2022-0175 at the following URLs: [Link 1](https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2039343), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2039342).
- agent/first-publish-date
- agent/remedy
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-0175
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/description
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/event
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/virglrenderer project
- canonical/freedesktop virglrenderer
- version/freedesktop virglrenderer/0.9.0
- version/freedesktop virglrenderer/0.9.1
- vendor/redhat
- canonical/red hat enterprise linux
- version/red hat enterprise linux/8.0