Every CVE Search/ Get API key

CVE-2017-5580

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6...

7.1 HighFix available

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.49%Down 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.1

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.

Record
CVE-2017-5580
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.

Record
CVE-2017-5580
Updated
2026-11-02
EUVDEUVD-2017-14681 No score

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.

Record
EUVD-2017-14681
Updated
2026-11-03
GitHub AdvisoriesGHSA-4v7q-34w2-x874 7.1

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6...

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.

Record
GHSA-4v7q-34w2-x874
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 7.1

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.

Record
CVE-2017-5580
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-5580 7.1

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.

Record
DEBIAN-CVE-2017-5580
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-5580 7.1

The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.

Record
UBUNTU-CVE-2017-5580
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2017:0798-1 No score

Security update for virglrenderer

This update for virglrenderer fixes the following issues:

Security issues fixed:

  • CVE-2017-6386: memory leakage while in vrend_create_vertex_elements_state (bsc#1027376)
  • CVE-2017-6355: integer overflow while creating shader object (bsc#1027108)
  • CVE-2017-6317: fix memory leak in add shader program (bsc#1026922)
  • CVE-2017-6210: null pointer dereference in vrend_decode_reset (bsc#1026725)
  • CVE-2017-6209: stack buffer oveflow in parse_identifier (bsc#1026723)
  • CVE-2017-5994: out-of-bounds access in vrend_create_vertex_elements_state (bsc#1025507)
  • CVE-2017-5993: host memory leakage when initialising blitter context (bsc#1025505)
  • CVE-2017-5957: stack overflow in vrend_decode_set_framebuffer_state (bsc#1024993)
  • CVE-2017-5956: OOB access while in vrend_draw_vbo (bsc#1024992)
  • CVE-2017-5937: null pointer dereference in vrend_clear (bsc#1024232)
  • CVE-2017-5580: OOB access while parsing texture instruction (bsc#1021627)
  • CVE-2016-10214: host memory leak issue in virgl_resource_attach_backing (bsc#1024244)
  • CVE-2016-10163: host memory leakage when creating decode context (bsc#1021616)
Record
SUSE-SU-2017:0798-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
virglrenderer
Debian:12
 before 0.6.0-1
0.6.0-1
virglrenderer
Debian:13
 before 0.6.0-1
0.6.0-1
virglrenderer
Debian:14
 before 0.6.0-1
0.6.0-1
virglrenderer
SUSE:Linux Enterprise Desktop 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Software Development Kit 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-5580 is a high vulnerability (CVSS 7.1) in Virglrenderer Project Virglrenderer, published March 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in virglrenderer 0.6.0-1.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open