{"id":"CVE-2019-18390","details":"An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands.","modified":"2026-07-08T17:16:58.586471Z","published":"2019-12-23T16:15:11.243Z","related":["SUSE-SU-2020:0016-1","SUSE-SU-2020:0017-1","openSUSE-SU-2020:0058-1","openSUSE-SU-2024:11499-1"],"database_specific":{"unresolved_ranges":[{"vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.0"},{"last_affected":"10.0"}],"source":"CPE_STRING"},{"vendor_product":"opensuse:leap","cpes":["cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.1"},{"last_affected":"15.1"}],"source":"CPE_STRING"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux"}]},"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.html"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/cve-2019-18390"},{"type":"ADVISORY","url":"https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=d2cdbcf6a8f2317f250fd54f08aa35dde2fa3e30#3cd772559e0d73afa136d6818023cfd0c4c8ecc0_0_151"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00017.html"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1765584"},{"type":"FIX","url":"https://gitlab.freedesktop.org/virgl/virglrenderer/commit/24f67de7a9088a873844a39be03cee6882260ac9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/virgl/virglrenderer","events":[{"introduced":"0"},{"last_affected":"48cc96c9aebb9d0164830a157efc8916f08f00c0"},{"fixed":"24f67de7a9088a873844a39be03cee6882260ac9"}],"database_specific":{"cpe":"cpe:2.3:a:virglrenderer_project:virglrenderer:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"0.8.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["virglrenderer-0.8.0","virglrenderer-0.7.0","virglrenderer-0.6.0","virglrenderer-0.5.0","virglrenderer-0.4.0","virglrenderer-0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-18390.json","vanir_signatures_modified":"2026-07-08T17:16:58Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["295718410517094950528114583803510995894","43468277317181871649856080072575986996","249655131899309062348327631190168477966"],"threshold":0.9},"id":"CVE-2019-18390-1dd0f6fb","signature_type":"Line","signature_version":"v1","source":"https://gitlab.freedesktop.org/virgl/virglrenderer@24f67de7a9088a873844a39be03cee6882260ac9","target":{"file":"src/virgl_hw.h"}},{"id":"CVE-2019-18390-6bbeadc1","signature_type":"Line","signature_version":"v1","source":"https://gitlab.freedesktop.org/virgl/virglrenderer@24f67de7a9088a873844a39be03cee6882260ac9","target":{"file":"src/vrend_renderer.c"},"deprecated":false,"digest":{"line_hashes":["203327541951848299864613017926910193462","42597155943745953960949306703066152174","163259354468978262870234779266794485686","104382142299863661724756600661953964042","195073412259000187659366091482833080495","221501829541838785924229101314879422744","272004653704100493015803223915055268624"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"103917660898869094351024064010480370128","length":2421},"id":"CVE-2019-18390-e6c43cf8","signature_type":"Function","signature_version":"v1","source":"https://gitlab.freedesktop.org/virgl/virglrenderer@24f67de7a9088a873844a39be03cee6882260ac9","target":{"file":"src/vrend_renderer.c","function":"vrend_renderer_blit"}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}