Every CVE Search/ Get API key

CVE-2017-6209

Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary...

6.5 MediumFix available

Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.39%Down 1.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.

Record
CVE-2017-6209
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.

Record
CVE-2017-6209
Updated
2026-11-02
EUVDEUVD-2017-15274 No score

Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.

Record
EUVD-2017-15274
Updated
2026-11-03
GitHub AdvisoriesGHSA-rm3c-835j-xh83 6.5

Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary...

Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.

Record
GHSA-rm3c-835j-xh83
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 6.5

Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.

Record
CVE-2017-6209
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-6209 6.5

Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.

Record
DEBIAN-CVE-2017-6209
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-6209 6.5

Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.

Record
UBUNTU-CVE-2017-6209
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2017:0798-1 No score

Security update for virglrenderer

This update for virglrenderer fixes the following issues:

Security issues fixed:

  • CVE-2017-6386: memory leakage while in vrend_create_vertex_elements_state (bsc#1027376)
  • CVE-2017-6355: integer overflow while creating shader object (bsc#1027108)
  • CVE-2017-6317: fix memory leak in add shader program (bsc#1026922)
  • CVE-2017-6210: null pointer dereference in vrend_decode_reset (bsc#1026725)
  • CVE-2017-6209: stack buffer oveflow in parse_identifier (bsc#1026723)
  • CVE-2017-5994: out-of-bounds access in vrend_create_vertex_elements_state (bsc#1025507)
  • CVE-2017-5993: host memory leakage when initialising blitter context (bsc#1025505)
  • CVE-2017-5957: stack overflow in vrend_decode_set_framebuffer_state (bsc#1024993)
  • CVE-2017-5956: OOB access while in vrend_draw_vbo (bsc#1024992)
  • CVE-2017-5937: null pointer dereference in vrend_clear (bsc#1024232)
  • CVE-2017-5580: OOB access while parsing texture instruction (bsc#1021627)
  • CVE-2016-10214: host memory leak issue in virgl_resource_attach_backing (bsc#1024244)
  • CVE-2016-10163: host memory leakage when creating decode context (bsc#1021616)
Record
SUSE-SU-2017:0798-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
virglrenderer
Debian:12
 before 0.6.0-1
0.6.0-1
virglrenderer
Debian:13
 before 0.6.0-1
0.6.0-1
virglrenderer
Debian:14
 before 0.6.0-1
0.6.0-1
virglrenderer
SUSE:Linux Enterprise Desktop 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Software Development Kit 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1
virglrenderer
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 13 CVEs
 before 0.5.0-11.1
0.5.0-11.1

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-6209 is a medium vulnerability (CVSS 6.5) in Virglrenderer Project Virglrenderer, published March 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in virglrenderer 0.6.0-1.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open