[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAFkFYGhoZ8aYfL-7SP9M39vXd-g_KHoAF1gy8vQ_C+7s=9PtUg@mail.gmail.com>
Date: Tue, 29 Oct 2024 17:35:38 +0100
From: Jose Exposito Quintana <jexposit@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-9632: X.Org X server and Xwayland: Heap-based buffer overflow privilege escalation in _XkbSetCompatMap
---------- Forwarded message ---------
From: Jose Exposito Quintana <jexposit@...hat.com>
Date: Tue, Oct 29, 2024 at 5:16 PM
Subject: X.Org Security Advisory: Issues in X.Org X server prior to 21.1.14
and Xwayland prior to 24.1.4
To: <xorg-announce@...ts.x.org>, <xorg@...ts.x.org>
X.Org Security Advisory: October 29, 2024
Issues in X.Org X server prior to 21.1.14 and Xwayland prior to 24.1.4
========================================================================
An issue has been found in the X server and Xwayland implementations
published by X.Org for which we are releasing security fixes for in
xorg-server-21.1.14 and xwayland-24.1.4.
1) CVE-2024-9632 can be triggered by providing a modified bitmap to the
X.Org server.
------------------------------------------------------------------------
1) CVE-2024-9632: Heap-based buffer overflow privilege escalation in
_XkbSetCompatMap
Introduced in: xorg-server-1.1.1 (2006)
Fixed in: xorg-server-21.1.14 and xwayland-24.1.4
Fix:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/85b776571487f52e756f68a069c768757369bfe3
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
buffer.
However, It didn't update its size properly. It updated `num_si` only,
without updating `size_si`.
This may lead to local privilege escalation if the server is run as root
or remote code execution (e.g. x11 over ssh).
xorg-server-21.1.14 and xwayland-24.1.4 have been patched to fix this issue.
------------------------------------------------------------------------
X.Org thanks all of those who reported and fixed these issues, and those
who helped with the review and release of this advisory and these fixes.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
