Bug 2256540 (CVE-2024-21885, ZDI-CAN-22744)
| Summary: | CVE-2024-21885 xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Robb Gatica <rgatica> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | xorg-server-21.1.11, xwayland-23.2.4 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2258932, 2258933 | ||
| Bug Blocks: | 2256538 | ||
|
Description
Robb Gatica
2024-01-02 22:06:53 UTC
Created tigervnc tracking bugs for this issue: Affects: fedora-all [bug 2258933] Created xorg-x11-server tracking bugs for this issue: Affects: fedora-all [bug 2258932] This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2024:0320 https://access.redhat.com/errata/RHSA-2024:0320 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:0557 https://access.redhat.com/errata/RHSA-2024:0557 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2024:0558 https://access.redhat.com/errata/RHSA-2024:0558 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:0597 https://access.redhat.com/errata/RHSA-2024:0597 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:0607 https://access.redhat.com/errata/RHSA-2024:0607 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2024:0614 https://access.redhat.com/errata/RHSA-2024:0614 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:0621 https://access.redhat.com/errata/RHSA-2024:0621 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2024:0617 https://access.redhat.com/errata/RHSA-2024:0617 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:0626 https://access.redhat.com/errata/RHSA-2024:0626 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2024:0629 https://access.redhat.com/errata/RHSA-2024:0629 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:2170 https://access.redhat.com/errata/RHSA-2024:2170 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:2169 https://access.redhat.com/errata/RHSA-2024:2169 |