CVE-2019-18391

Name of the Vulnerable Software and Affected Versions virglrenderer versions prior to 0.8.0

Description A heap-based buffer overflow issue in the vrend renderer transfer write iov function allows guest OS users to cause a denial of service via VIRGL CCMD RESOURCE INLINE WRITE commands. This issue is related to a buffer overflow in memory, which can be exploited to disrupt service.

Recommendations For versions prior to 0.8.0, update to a version 0.8.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vrend renderer transfer write iov function until a patch is available. Avoid using the VIRGL CCMD RESOURCE INLINE WRITE commands in the affected API endpoint until the issue is resolved.