PT-2017-16995 · Virgl+2 · Virglrenderer+2

Li Qiang · Published 2017-03-15 · Updated 2019-10-03 · CVE-2017-6317

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions virglrenderer versions prior to 0.6.0

Description The issue is related to a memory leak in the add shader program function, which can be exploited by local guest OS users to cause a denial of service through host memory consumption. This is achieved via vectors involving the sprog variable.

Recommendations For versions prior to 0.6.0, update to version 0.6.0 or later to resolve the issue.

Fix

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

ALT-PU-2017-1538

CVE-2017-6317

SUSE-SU-2017:0798-1

Affected Products

Alt Linux

Suse

Virglrenderer

References · 53

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5956 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6210 · Security Note
• https://cgit.freedesktop.org/virglrenderer/commit/?id=a2f12a1b0f95b13b6f8dc3d05d7b74b4386394e4 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6209 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5580 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-6317 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5937 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5994 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-1538 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1426756 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-6317 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-6317 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6317 · Vendor Advisory
• http://openwall.com/lists/oss-security/2017/02/24/5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-6317 · Security Note