Bugzilla – Bug 1159486
VUL-0: CVE-2019-18391: virglrenderer: heap based buffer overflow in the vrend_renderer_transfer_write_iov function
Last modified: 2020-01-15 05:11:53 UTC
rh#1765589 A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands. Upstream Issue: https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=8c9cfb4e425542e96f0717189fe4658555baaf08 patch: https://gitlab.freedesktop.org/virgl/virglrenderer/commit/2abeb1802e3c005b17a7123e382171b3fb665971 References: https://bugzilla.redhat.com/show_bug.cgi?id=1765589 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18391
tracking as affected: - SUSE:SLE-12-SP2:Update - SUSE:SLE-15:Update
Lin, can you take this since I'm on vacation for the next two weeks.
SUSE-SU-2020:0016-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1159478,1159479,1159482,1159486 CVE References: CVE-2019-18388,CVE-2019-18389,CVE-2019-18390,CVE-2019-18391 Sources used: SUSE OpenStack Cloud Crowbar 8 (src): virglrenderer-0.5.0-12.3.1 SUSE OpenStack Cloud 8 (src): virglrenderer-0.5.0-12.3.1 SUSE OpenStack Cloud 7 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP5 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP4 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Desktop 12-SP4 (src): virglrenderer-0.5.0-12.3.1 SUSE Enterprise Storage 5 (src): virglrenderer-0.5.0-12.3.1 HPE Helion Openstack 8 (src): virglrenderer-0.5.0-12.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:0017-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1159478,1159479,1159482,1159486 CVE References: CVE-2019-18388,CVE-2019-18389,CVE-2019-18390,CVE-2019-18391 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): virglrenderer-0.6.0-4.3.1 SUSE Linux Enterprise Module for Server Applications 15 (src): virglrenderer-0.6.0-4.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): virglrenderer-0.6.0-4.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): virglrenderer-0.6.0-4.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:0058-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1159478,1159479,1159482,1159486 CVE References: CVE-2019-18388,CVE-2019-18389,CVE-2019-18390,CVE-2019-18391 Sources used: openSUSE Leap 15.1 (src): virglrenderer-0.6.0-lp151.4.3.1