REDHAT-BUG-1427472: Low severity freedesktop virgl 3d vulnerability

Published Feb 28, 2017

Updated

Virgil 3d project, used by Quick Emulator(Qemu) to implement 3D GPU support for the virtio GPU, is vulnerable to memory leakage issue. It could occur when a guest tries to create vertex elements via 'VIRGLOBJECTVERTEXELEMENTS' command.

A guest user/process could use this flaw to leak host memory resulting in DoS.

Upstream patch: --------------- -> https://cgit.freedesktop.org/virglrenderer/commit/?id=737c3350850ca4dbc5633b3bdb4118176ce59920

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/03/01/7

Affected Software

2 affected components

Freedesktop Virgl 3D

Qemu Qemu

Event History

Feb 28, 2017

Data Sourced

via Red Hat·10:07 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1427472?

The severity of REDHAT-BUG-1427472 is high due to the potential for memory leakage from the host.

How do I fix REDHAT-BUG-1427472?

To fix REDHAT-BUG-1427472, update to the latest version of Freedesktop Virgl 3D or QEMU that addresses this vulnerability.

What causes the vulnerability in REDHAT-BUG-1427472?

The vulnerability in REDHAT-BUG-1427472 is caused by a memory leakage issue when a guest creates vertex elements using specific commands.

Who is affected by REDHAT-BUG-1427472?

Freedesktop Virgl 3D and QEMU users are affected by REDHAT-BUG-1427472.

Can exploitation of REDHAT-BUG-1427472 lead to data loss?

Yes, exploitation of REDHAT-BUG-1427472 could expose sensitive data by leaking host memory.