Debian Security Advisory

DLA-3232-1 virglrenderer -- LTS security update

Date Reported:
07 Dec 2022
Affected Packages:
virglrenderer
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 946942, Bug 949954, Bug 1009073.
In Mitre's CVE dictionary: CVE-2019-18388, CVE-2019-18389, CVE-2019-18390, CVE-2019-18391, CVE-2020-8002, CVE-2020-8003, CVE-2022-0135.
More information:

Several security vulnerabilities were discovered in virglrenderer, a virtual GPU for KVM virtualization.

  • CVE-2019-18388

    A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malformed commands.

  • CVE-2019-18389

    A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.

  • CVE-2019-18390

    An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands.

  • CVE-2019-18391

    A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.

  • CVE-2020-8002

    A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands that attempt to launch a grid without previously providing a Compute Shader (CS).

  • CVE-2020-8003

    A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering texture allocation failure, because vrend_renderer_resource_allocated_texture is not an appropriate place for a free.

  • CVE-2022-0135

    An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted virgil resource and then issue a VIRTGPU_EXECBUFFER ioctl, leading to a denial of service or possible code execution.

For Debian 10 buster, these problems have been fixed in version 0.7.0-2+deb10u1.

We recommend that you upgrade your virglrenderer packages.

For the detailed security status of virglrenderer please refer to its security tracker page at: https://security-tracker.debian.org/tracker/virglrenderer

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS