Bug 866821 – <media-libs/virglrenderer-0.10.1: code execution via malicious guest

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-08-26 18:44:03 UTC]

CVE-2022-0135:

An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted virgil resource and then issue a VIRTGPU_EXECBUFFER ioctl, leading to a denial of service or possible code execution.

Patch: https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/95e581fd181b213c2ed7cdc63f2abc03eaaa77ec

[Comment 1 John Helmert III 2022-08-27 02:55:44 UTC]

CVE-2022-0175:

A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.

Unreleased patch: https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c
RedHat bug: https://bugzilla.redhat.com/show_bug.cgi?id=2039003

[Comment 2 John Helmert III 2022-09-08 05:14:03 UTC]

Sorry, both fixes in 0.10.0 and beyond

[Comment 3 Larry the Git Cow 2022-10-09 03:26:22 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f957cf49020a73e35603b61f76fa2bfc55ab6862

commit f957cf49020a73e35603b61f76fa2bfc55ab6862
Author:     John Helmert III <[e-mail]>
AuthorDate: 2022-10-09 03:22:41 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-10-09 03:24:43 +0000

    media-libs/virglrenderer: drop 0.8.2
    
    Bug: https://bugs.gentoo.org/866821
    Signed-off-by: John Helmert III <[e-mail]>

 media-libs/virglrenderer/Manifest                  |  1 -
 .../virglrenderer/virglrenderer-0.8.2.ebuild       | 46 ----------------------
 2 files changed, 47 deletions(-)

[Comment 4 John Helmert III 2022-10-14 03:07:30 UTC]

GLSA request filed

[Comment 5 Larry the Git Cow 2022-10-16 14:46:08 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=6716ac8ba9951aebe155f31ca4c5eb9e3ed0f660

commit 6716ac8ba9951aebe155f31ca4c5eb9e3ed0f660
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-10-16 14:41:23 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-10-16 14:45:23 +0000

    [ GLSA 202210-05 ] virglrenderer: Multiple vulnerabilities
    
    Bug: https://bugs.gentoo.org/866821
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202210-05.xml | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

[Comment 6 John Helmert III 2022-10-16 14:57:42 UTC]

GLSA released, all done!