Bug 2163813 (CVE-2023-24039)

Summary:	CVE-2023-24039 motif: libXm: stack-based buffer overflow in ParseColors()
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	csoriano, peter.hutterer
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in libXm, a library distributed by the motif package. A specially crafted XPM file with long color strings can lead to a stack-based buffer overflow in the ParseColors function due to the unsafe use of the strcat function, resulting in privilege escalation.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-01-27 20:22:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2163814
Bug Blocks:	2164418

Description Mauro Matteo Cascella 2023-01-24 13:34:06 UTC

A stack-based buffer overflow was found in the ParseColors() function of libXm. This vulnerability is caused by the unchecked use of the unsafe API function strcat() and can be triggered via a specially crafted XPM icon with long color strings. The flaw was demonstrated to be exploitable by local unprivileged users via the dtprintinfo setuid binary to achieve local privilege escalation to root on Solaris 10.

*NOTE* The dtprintinfo setuid binary is not distributed with Red Hat Enterprise Linux. Red Hat never provided support for CDE (Common Desktop Environment). See https://access.redhat.com/solutions/5547801 for more information.

References:
https://security.humanativaspa.it/nothing-new-under-the-sun/
https://github.com/hnsecurity/vulns/blob/main/HNS-2022-01-dtprintinfo.txt

Comment 1 Mauro Matteo Cascella 2023-01-24 13:34:36 UTC

Created libXpm tracking bugs for this issue:

Affects: fedora-all [bug 2163814]

Comment 2 Peter Hutterer 2023-01-24 23:52:21 UTC

Note that this issue is in libXm (i.e. motif), not libXpm the X11 Pixmap library.

Comment 3 Product Security DevOps Team 2023-01-27 20:22:18 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-24039