Vulnerability Description
An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted virgil resource and then issue a VIRTGPU_EXECBUFFER ioctl, leading to a denial of service or possible code execution.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Virglrenderer Project | Virglrenderer | >= 0.8.1, < 0.10.0 |
| Redhat | Enterprise Linux | 8.0 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2037790Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/12/msg00017.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202210-05Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2037790Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/12/msg00017.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202210-05Third Party Advisory
FAQ
What is CVE-2022-0135?
CVE-2022-0135 is a vulnerability with a CVSS score of 7.8 (HIGH). An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted virgil resource and then issue a VIRTGPU_E...
How severe is CVE-2022-0135?
CVE-2022-0135 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-0135?
Check the references section above for vendor advisories and patch information. Affected products include: Virglrenderer Project Virglrenderer, Redhat Enterprise Linux, Debian Debian Linux.