Bugzilla – Bug 1159478
VUL-1: CVE-2019-18390: virglrenderer: out-of-bounds read in the vrend_blit_need_swizzle may lead to DoS
Last modified: 2024-05-24 10:17:07 UTC
rh#1765584 An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands. Upstream Issue: https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=d2cdbcf6a8f2317f250fd54f08aa35dde2fa3e30#3cd772559e0d73afa136d6818023cfd0c4c8ecc0_0_151 patch: https://gitlab.freedesktop.org/virgl/virglrenderer/commit/24f67de7a9088a873844a39be03cee6882260ac9 References: https://bugzilla.redhat.com/show_bug.cgi?id=1765584 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18390
affects: - SUSE:SLE-12-SP2:Update - SUSE:SLE-15:Update
Lin, can you take this since I'm on vacation for the next two weeks.
SUSE-SU-2020:0016-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1159478,1159479,1159482,1159486 CVE References: CVE-2019-18388,CVE-2019-18389,CVE-2019-18390,CVE-2019-18391 Sources used: SUSE OpenStack Cloud Crowbar 8 (src): virglrenderer-0.5.0-12.3.1 SUSE OpenStack Cloud 8 (src): virglrenderer-0.5.0-12.3.1 SUSE OpenStack Cloud 7 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP5 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP4 (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): virglrenderer-0.5.0-12.3.1 SUSE Linux Enterprise Desktop 12-SP4 (src): virglrenderer-0.5.0-12.3.1 SUSE Enterprise Storage 5 (src): virglrenderer-0.5.0-12.3.1 HPE Helion Openstack 8 (src): virglrenderer-0.5.0-12.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:0017-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1159478,1159479,1159482,1159486 CVE References: CVE-2019-18388,CVE-2019-18389,CVE-2019-18390,CVE-2019-18391 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): virglrenderer-0.6.0-4.3.1 SUSE Linux Enterprise Module for Server Applications 15 (src): virglrenderer-0.6.0-4.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): virglrenderer-0.6.0-4.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): virglrenderer-0.6.0-4.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:0058-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1159478,1159479,1159482,1159486 CVE References: CVE-2019-18388,CVE-2019-18389,CVE-2019-18390,CVE-2019-18391 Sources used: openSUSE Leap 15.1 (src): virglrenderer-0.6.0-lp151.4.3.1
Released. Closing bug.