CVE-2017-6386

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Memory leak in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_OBJECT_VERTEX_ELEMENTS commands.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-772

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2017/03/01/7Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/96506Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1427472Issue Tracking, Patch, Third Party Advisory
https://cgit.freedesktop.org/virglrenderer/commit/?id=737c3350850ca4dbc5633b3bdb4118176ce59920Patch, Third Party Advisory
https://security.gentoo.org/glsa/201707-06Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/03/01/7Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/96506Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1427472Issue Tracking, Patch, Third Party Advisory
https://cgit.freedesktop.org/virglrenderer/commit/?id=737c3350850ca4dbc5633b3bdb4118176ce59920Patch, Third Party Advisory
https://security.gentoo.org/glsa/201707-06Third Party Advisory

Timeline

Published: Mar 15, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-63875.5The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (out-of-bounds read CVE-2017-63906.1An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtra CVE-2017-63916.1An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed CVE-2017-63926.1An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed CVE-2017-63936.1An issue was discovered in NagVis 1.9b12. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "nagvi CVE-2017-63946.1Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient fil CVE-2017-63956.1An issue was discovered in HashOver 2.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the 'hashov CVE-2017-63966.1An issue was discovered in WPO-Foundation WebPageTest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data pas CVE-2017-63976.1An issue was discovered in FlightAirMap v1.0-beta.10. The vulnerability exists due to insufficient filtration of user-supplied data in multi CVE-2017-63988.8An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a termin CVE-2017-63998.8An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Privileged remote command execution on NetBa CVE-2017-64008.8An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Privileged command execution on NetBackup Se