CVE-2022-0175

A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
VendorProductVersion
virglrenderer_projectvirglrenderer
0.9.0
virglrenderer_projectvirglrenderer
0.9.1
redhatenterprise_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
virglrenderer
bullseye
0.8.2-5+deb11u1
fixed
bookworm
0.10.4-1
fixed
sid
1.0.0-1
fixed
trixie
1.0.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
virglrenderer
noble
Fixed 0.9.1-1~exp1ubuntu2
released
mantic
Fixed 0.9.1-1~exp1ubuntu2
released
lunar
Fixed 0.9.1-1~exp1ubuntu2
released
kinetic
Fixed 0.9.1-1~exp1ubuntu2
released
jammy
Fixed 0.9.1-1~exp1ubuntu2
released
impish
Fixed 0.8.2-5ubuntu0.21.10.1
released
focal
Fixed 0.8.2-1ubuntu1.1
released
bionic
needed
xenial
ignored
trusty
ignored