CVE-2022-0175

Katalog CVE

CVSS 5.5 · Medium EPSS 0,32%

Kerentanan Missing Initialization of Resource pada virglrenderer project virglrenderer, redhat enterprise linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.

Rincian

Terbit di NVD

26 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-909: Missing Initialization of Resource

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=2039003 issue tracking · patch · advisory pihak ketiga
• https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c patch · advisory pihak ketiga
• https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654 patch · advisory pihak ketiga
• https://security-tracker.debian.org/tracker/CVE-2022-0175 patch · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2022-0175 advisory pihak ketiga
• https://security.gentoo.org/glsa/202210-05 advisory pihak ketiga