ZDI-CAN-22744 - VULNERABILITY DETAILS * Version tested:1.21.1.7 * Installer file:- * Platform tested:debian-live-12.2.0-amd64-xfce.iso ### Analysis The exploit doesn't work if the OS installed on vmware and default virtualbox it works on virtualbox with VBoxVGA graphic controller XISendDeviceHierarchyEvent() function allocated the fixed length array for struct xXIHierarchyInfo. However, If a device with a given ID was removed and a new device with the same ID added the info structs might be written to the array of struct xXIHierarchyInfo twice and over the size limit. It leads to heap overflow and LPE for some distributions (xorg in debian xfce is run as root under specific display driver) and RCE for ssh x11 forwarding environment. Reference: https://gitlab.freedesktop.org/xorg/xserver/-/blob/8cce7f5d64d4f1027801892631b65b2c859cc559/Xi/xichangehierarchy.c#L60
Created tigervnc tracking bugs for this issue: Affects: fedora-all [bug 2258933] Created xorg-x11-server tracking bugs for this issue: Affects: fedora-all [bug 2258932]
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2024:0320 https://access.redhat.com/errata/RHSA-2024:0320
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:0557 https://access.redhat.com/errata/RHSA-2024:0557
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2024:0558 https://access.redhat.com/errata/RHSA-2024:0558
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:0597 https://access.redhat.com/errata/RHSA-2024:0597
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:0607 https://access.redhat.com/errata/RHSA-2024:0607
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2024:0614 https://access.redhat.com/errata/RHSA-2024:0614
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:0621 https://access.redhat.com/errata/RHSA-2024:0621
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2024:0617 https://access.redhat.com/errata/RHSA-2024:0617
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:0626 https://access.redhat.com/errata/RHSA-2024:0626
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2024:0629 https://access.redhat.com/errata/RHSA-2024:0629