Every CVE Search/ Get API key

CVE-2017-5937

The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer...

6.5 MediumFix available

The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.40%Down 0.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.

Record
CVE-2017-5937
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.

Record
CVE-2017-5937
Updated
2026-11-02
EUVDEUVD-2017-15009 No score

The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.

Record
EUVD-2017-15009
Updated
2026-11-03
GitHub AdvisoriesGHSA-g4qq-w8w3-624q 6.5

The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer...

The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.

Record
GHSA-g4qq-w8w3-624q
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 6.5

The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.

Record
CVE-2017-5937
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-5937 6.5

The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.

Record
DEBIAN-CVE-2017-5937
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-5937 6.5

The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.

Record
UBUNTU-CVE-2017-5937
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:11499-1 No score

libvirglrenderer1-0.9.1-1.3 on GA media

These are all security issues fixed in the libvirglrenderer1-0.9.1-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11499-1
Updated
2026-11-02
OSVSUSE-SU-2017:0798-1 No score

Security update for virglrenderer

This update for virglrenderer fixes the following issues:

Security issues fixed:

  • CVE-2017-6386: memory leakage while in vrend_create_vertex_elements_state (bsc#1027376)
  • CVE-2017-6355: integer overflow while creating shader object (bsc#1027108)
  • CVE-2017-6317: fix memory leak in add shader program (bsc#1026922)
  • CVE-2017-6210: null pointer dereference in vrend_decode_reset (bsc#1026725)
  • CVE-2017-6209: stack buffer oveflow in parse_identifier (bsc#1026723)
  • CVE-2017-5994: out-of-bounds access in vrend_create_vertex_elements_state (bsc#1025507)
  • CVE-2017-5993: host memory leakage when initialising blitter context (bsc#1025505)
  • CVE-2017-5957: stack overflow in vrend_decode_set_framebuffer_state (bsc#1024993)
  • CVE-2017-5956: OOB access while in vrend_draw_vbo (bsc#1024992)
  • CVE-2017-5937: null pointer dereference in vrend_clear (bsc#1024232)
  • CVE-2017-5580: OOB access while parsing texture instruction (bsc#1021627)
  • CVE-2016-10214: host memory leak issue in virgl_resource_attach_backing (bsc#1024244)
  • CVE-2016-10163: host memory leakage when creating decode context (bsc#1021616)
Record
SUSE-SU-2017:0798-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
virglrenderer
Debian:12
 before 0.6.0-1
0.6.0-1
virglrenderer
Debian:13
 before 0.6.0-1
0.6.0-1
virglrenderer
Debian:14
 before 0.6.0-1
0.6.0-1
virglrenderer
SUSE:Linux Enterprise Desktop 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Software Development Kit 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 0.9.1-1.3
0.9.1-1.3

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-5937 is a medium vulnerability (CVSS 6.5) in Virglrenderer Project Virglrenderer, published March 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in virglrenderer 0.6.0-1.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open