CVE-2020-8003

Publication date 27 January 2020

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

5.5 · Medium

Score breakdown

A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering texture allocation failure, because vrend_renderer_resource_allocated_texture is not an appropriate place for a free.

Read the notes from the security team

Status

Package Ubuntu Release Status
virglrenderer 19.10 eoan
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial Not in release
14.04 LTS trusty Not in release

Notes

mdeslaur

looks like the double-free was introduced here: https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/0d9a2c88dc3a70023541b3260b9f00c982abda16

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
virglrenderer

Severity score breakdown

Parameter Value
Base score 5.5 · Medium
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H