CVE-2022-0175

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-26 · updated 2026-06-17
Weakness: CWE-909

Description

A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.

Affected products

Red Hat Enterprise Linux: 8.0
Virglrenderer Project Virglrenderer: 0.9.0, 0.9.1

References

https://access.redhat.com/security/cve/CVE-2022-0175
https://bugzilla.redhat.com/show_bug.cgi?id=2039003
https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c
https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654
https://security-tracker.debian.org/tracker/CVE-2022-0175
https://security.gentoo.org/glsa/202210-05
https://access.redhat.com/security/cve/CVE-2022-0175
https://bugzilla.redhat.com/show_bug.cgi?id=2039003
https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c
https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654
https://security-tracker.debian.org/tracker/CVE-2022-0175
https://security.gentoo.org/glsa/202210-05

Get alerted when CVE-2022-0175 or the next vulnerability affects your stack