REDHAT-BUG-1422452
First published: Wed Feb 15 2017(Updated: )
Virgil 3d project, used by Quick Emulator(Qemu) to implement 3D GPU support for the virtio GPU, is vulnerable to an OOB array access issue. It could occur when creating vertex elements array in vrend_create_vertex_elements_state(). A guest user/process could use this flaw to crash the Qemu process instance resulting DoS. Upstream patch: --------------- -> <a href="https://cgit.freedesktop.org/virglrenderer/commit/?id=114688c526fe45f341d75ccd1d85473c3b08f7a7">https://cgit.freedesktop.org/virglrenderer/commit/?id=114688c526fe45f341d75ccd1d85473c3b08f7a7</a> Reference: ---------- -> <a href="http://www.openwall.com/lists/oss-security/2017/02/15/8">http://www.openwall.com/lists/oss-security/2017/02/15/8</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| libvirglrenderer | ||
| QEMU |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-1422452?
REDHAT-BUG-1422452 is classified as a high severity vulnerability due to the potential for crashing the Qemu process.
How do I fix REDHAT-BUG-1422452?
To fix REDHAT-BUG-1422452, update to the latest version of Qemu or apply the relevant patches provided by the developers.
Which software is affected by REDHAT-BUG-1422452?
The affected software includes the Freedesktop Virglrenderer and Open Source Qemu.
What strategies can be used to mitigate REDHAT-BUG-1422452?
To mitigate REDHAT-BUG-1422452, consider limiting the privileges of guest users and ensuring that your Qemu environment is correctly configured.
What type of vulnerability is REDHAT-BUG-1422452?
REDHAT-BUG-1422452 is an out-of-bounds (OOB) array access vulnerability that can be exploited to crash the Qemu process.
- agent/references
- agent/last-modified-date
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-5994
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/freedesktop
- canonical/libvirglrenderer
- vendor/open source
- canonical/qemu