Vulnerability · Published Aug 26, 2022 · Assigned by redhat
CVE-2022-0175
Medium 5.5
In plain English
A medium-severity security flaw in virglrenderer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.3%top 74.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | virglrenderer | 0.10.3-r0 | ALPINE-CVE-2022-0175 |
| Alpine:v3.21 | virglrenderer | 0.10.3-r0 | ALPINE-CVE-2022-0175 |
| Alpine:v3.22 | virglrenderer | 0.10.3-r0 | ALPINE-CVE-2022-0175 |
| Alpine:v3.23 | virglrenderer | 0.10.3-r0 | ALPINE-CVE-2022-0175 |
| Alpine:v3.24 | virglrenderer | 0.10.3-r0 | ALPINE-CVE-2022-0175 |
| Ubuntu:22.04:LTS | virglrenderer | 0.9.1-1~exp1ubuntu2 | UBUNTU-CVE-2022-0175 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | virglrenderer | Affects v0.9.0 and later. |
Weakness: CWE-909
References
- https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654
- https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c
- https://bugzilla.redhat.com/show_bug.cgi?id=2039003
- https://security-tracker.debian.org/tracker/CVE-2022-0175
- https://access.redhat.com/security/cve/CVE-2022-0175
- GLSA-202210-05 vendor-advisory