CVE-2017-5580 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Project Virglrenderer

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents6 sources

Severity

7.1HIGHNVD

EPSS

0.1%

top 69.47%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Virglrenderer Project Virglrenderer

Timeline

PublishedMar 15

Latest updateMay 17

Description

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 2.5 | Impact: 4.0

Affected Packages2 packages

▶Debianvirglrenderer_project/virglrenderer< 0.6.0-1+3

▶NVDvirglrenderer_project/virglrenderer0.5.0

Patches

Patch: www.openwall.com ↗Patch: cgit.freedesktop.org ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

GHSA

GHSA-4v7q-34w2-x874: The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text↗2022-05-17

▶

CVEList

CVE-2017-5580: The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text↗2017-03-15

▶

OSV

CVE-2017-5580: The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text↗2017-03-15

▶

📋Vendor Advisories

Debian

CVE-2017-5580: virglrenderer - The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglren...↗2017

▶

💬Community

Bugzilla

CVE-2017-5580 Virglrenderer: OOB access while parsing instruction [fedora-all]↗2017-01-24

▶

Bugzilla

CVE-2017-5580 Virglrenderer: OOB access while parsing instruction↗2017-01-24

▶