Bug 2271999 (CVE-2024-31082) - CVE-2024-31082 xorg-x11-server: Heap buffer overread/data leakage in ProcAppleDRICreatePixmap
Summary: CVE-2024-31082 xorg-x11-server: Heap buffer overread/data leakage in ProcAppl...
Keywords:
Status: NEW
Alias: CVE-2024-31082
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2273330 2273331 2273329
Blocks: 2272001
TreeView+ depends on / blocked
 
Reported: 2024-03-28 04:27 UTC by TEJ RATHI
Modified: 2024-07-12 18:29 UTC (History)
1 user (show)

Fixed In Version: xorg-server 21.1.12
Doc Type: If docs needed, set a value
Doc Text:
A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description TEJ RATHI 2024-03-28 04:27:03 UTC
The ProcAppleDRICreatePixmap() function uses the byte-swapped length of the return data for the amount of data to return to the client, if the client has a different endianness than the X server. This function is only found in the Xquartz server for MacOS systems, and not in Xwayland, Xorg, or any other X servers.

Comment 1 Sandipan Roy 2024-04-04 08:21:34 UTC
Created tigervnc tracking bugs for this issue:

Affects: fedora-all [bug 2273331]


Created xorg-x11-server tracking bugs for this issue:

Affects: fedora-all [bug 2273329]


Created xorg-x11-server-Xwayland tracking bugs for this issue:

Affects: fedora-all [bug 2273330]


Note You need to log in before you can comment on or make changes to this bug.