CVE-2022-0175

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-909

Affected software

Vendor	Product	Versions
n/a	virglrenderer	Affects v0.9.0 and later.

References

https://access.redhat.com/security/cve/CVE-2022-0175Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2039003Issue Tracking, Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129cPatch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2022-0175Patch, Third Party Advisory
https://security.gentoo.org/glsa/202210-05Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-0175Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2039003Issue Tracking, Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129cPatch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2022-0175Patch, Third Party Advisory
https://security.gentoo.org/glsa/202210-05Third Party Advisory

Timeline

Published: Aug 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-01766.1The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it ba CVE-2022-01785.4Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.CVE-2022-01795.4snipe-it is vulnerable to Missing Authorization CVE-2022-01808.8Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the aut CVE-2022-01816.1Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitra CVE-2022-01825.4Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject CVE-2022-01834.6Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows CVE-2022-01844.3Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earl CVE-2022-01858.4A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux CVE-2022-01865.4The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gal CVE-2022-01885.3The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.CVE-2022-01896.1The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX ac