{"id":"CVE-2022-0175","details":"A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.","modified":"2026-08-12T12:49:08.462154Z","published":"2022-08-26T00:00:00Z","related":["SUSE-SU-2022:0110-1","SUSE-SU-2022:0111-1","openSUSE-SU-2022:0111-1","openSUSE-SU-2024:11770-1"],"database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-909"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0175.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2022-0175"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2022-0175"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0175.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0175"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202210-05"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2039003"},{"type":"FIX","url":"https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c"},{"type":"FIX","url":"https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/virgl/virglrenderer","events":[{"introduced":"2cd0803574117cfbf71feb4f6d28f712d8184a8e"},{"fixed":"b05bb61f454eeb8a85164c8a31510aeb9d79129c"}],"database_specific":{"cpe":["cpe:2.3:a:virglrenderer_project:virglrenderer:0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:virglrenderer_project:virglrenderer:0.9.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.9.0"},{"last_affected":"0.9.0"},{"introduced":"0.9.1"},{"last_affected":"0.9.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.9.0","0.9.1","Affects v0.9.0 and later.","virglrenderer-0.9.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0175.json","vanir_signatures_modified":"2026-08-12T12:49:08Z","vanir_signatures":[{"source":"https://gitlab.freedesktop.org/virgl/virglrenderer@b05bb61f454eeb8a85164c8a31510aeb9d79129c","target":{"file":"tests/test_virgl_transfer.c","function":"virgl_init_suite"},"deprecated":false,"digest":{"function_hash":"256077146312398307471656162861090729801","length":2722},"id":"CVE-2022-0175-18f1c017","signature_type":"Function","signature_version":"v1"},{"source":"https://gitlab.freedesktop.org/virgl/virglrenderer@b05bb61f454eeb8a85164c8a31510aeb9d79129c","target":{"file":"tests/test_virgl_transfer.c"},"deprecated":false,"digest":{"line_hashes":["96994566600589557309500908919060242648","277401736489299688690648715224349534235","298448684836469699733780436333872573349","35589618375021518938544604778652425168","95612179803856558666978191200428401238","314290784626386590002303889065489234740","152890258249067159615900496431663124396"],"threshold":0.9},"id":"CVE-2022-0175-292c6ef2","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/vrend_renderer.c","function":"vrend_resource_alloc_buffer"},"deprecated":false,"digest":{"function_hash":"206136490597754712570222257618109303063","length":1696},"id":"CVE-2022-0175-5d1437e9","signature_type":"Function","signature_version":"v1","source":"https://gitlab.freedesktop.org/virgl/virglrenderer@b05bb61f454eeb8a85164c8a31510aeb9d79129c"},{"deprecated":false,"digest":{"line_hashes":["74457806406748915352932023931697253405","33931677254939213498023179985908133204","44080038900611517499805128567371414839","63185170069030426663596365225759103433"],"threshold":0.9},"id":"CVE-2022-0175-dcc988f7","signature_type":"Line","signature_version":"v1","source":"https://gitlab.freedesktop.org/virgl/virglrenderer@b05bb61f454eeb8a85164c8a31510aeb9d79129c","target":{"file":"src/vrend_renderer.c"}}]}}],"schema_version":"1.9.0"}