CVE-2020-8003

NameCVE-2020-8003
DescriptionA double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering texture allocation failure, because vrend_renderer_resource_allocated_texture is not an appropriate place for a free.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3232-1
Debian Bugs949954

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
virglrenderer (PTS)buster0.7.0-2vulnerable
buster (security)0.7.0-2+deb10u1fixed
bullseye0.8.2-5+deb11u1fixed
bookworm0.10.4-1fixed
sid, trixie1.0.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
virglrenderersourcebuster0.7.0-2+deb10u1DLA-3232-1
virglrenderersource(unstable)0.8.2-1949954

Notes

https://gitlab.freedesktop.org/virgl/virglrenderer/commit/522b610a826f6de58c560cbb38fa8dfc65ae3c42

Search for package or bug name: Reporting problems