iDefense reported a vulnerability discovered by regenrecht affecting Xorg X server:

DESCRIPTION

Local exploitation of an integer overflow vulnerability in the X.Org X
server, as included in various vendors' operating system distributions,
could allow an attacker to execute arbitrary code with the privileges of
the X server, typically root.

The vulnerability exists within the code responsible for processing the
GetVisualInfo request. When processing this request, the server uses a
32-bit value provided by the client in an arithmetic operation that
calculates the number of bytes to allocate for a dynamic buffer. This
operation can overflow, which later leads to the buffer being
overflowed.

The vulnerable code is shown below:

From Xext/EVI.c:ProcEVIGetVisualInfo()

94  REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual *sz_VisualID32);

95  status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,

96   &eviInfo, &n_info, &conflict, &n_conflict);

From Xext/sampleEVI.c:sampleGetVisualInfo()

45  int max_sz_evi = n_visual * sz_xExtendedVisualInfo *
screenInfo.numScreens;

...

50  *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);

...

63  for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {

64   for (visualI = 0; visualI < n_visual; visualI++) {

65     evi[sz_evi].core_visual_id = visual[visualI];

On lines 95-96, several client controlled values are passed to the
sampleGetVisualInfo() function. On line 45, these values are multiplied
together, and on line 50 the result is passed to xalloc() to allocate a
buffer. In lines 63-65, this buffer is overflowed.

ANALYSIS

Exploitation allows an attacker to execute arbitrary code with root
privileges. In order to exploit this vulnerability, an attacker must be
able to send commands to an affected X server. This typically requires
access to the console or access to the same account as a user who is on
the console. One method of gaining the required access is to remotely
exploit a vulnerability in, for example, a graphical web browser. This
would then allow an attacker to exploit this vulnerability and elevate
their privileges to root.

If an X Server is configured to listen for TCP based client connections,
and a client is granted access to create sessions (via the xhosts file),
then the vulnerability can be exploited remotely.

WORKAROUND

If the EVI extension has not been built-in to the server, then it can be
prevented from loading by inserting the following into the X
configuration file (usually in /etc/X11/xorg.conf):

Section "Module"

        SubSection "extmod"

                Option "omit Extended-Visual-Information"

        EndSubSection

EndSection

To check if the extension is built-in to the server, grep the output of
the X Server log file:

grep built-in /var/log/Xorg.0.log

The result will list all built in extensions. The location of the log
file may need to be changed.