CVE-2019-18389

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.htmlMailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2019-18389Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1765577Issue Tracking, Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/commit/cbc8d8b75be360236cada63784046688aeb6d921Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=9c280a28651507e6ef87b17b90d47b6af3a4ab7dPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00017.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.htmlMailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2019-18389Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1765577Issue Tracking, Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/commit/cbc8d8b75be360236cada63784046688aeb6d921Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=9c280a28651507e6ef87b17b90d47b6af3a4ab7dPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00017.htmlMailing List, Third Party Advisory

Timeline

Published: Dec 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-18396.7A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux CVE-2019-183907.1An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to ca CVE-2019-183915.5A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows gue CVE-2019-183935.3PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct CVE-2019-183949.8A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send CVE-2019-183967.2An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the CVE-2019-183977.8A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacke CVE-2019-18407.5A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to res CVE-2019-184087.5archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_CVE-2019-184097.8The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if th CVE-2019-18418.1A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to inte CVE-2019-184118.8Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vuln