Bug 1168680 (CVE-2014-8091) - CVE-2014-8091 xorg-x11-server: denial of service due to unchecked malloc in client authentication
Summary: CVE-2014-8091 xorg-x11-server: denial of service due to unchecked malloc in c...
Alias: CVE-2014-8091
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1170916 1170917 1170918 1170919 1170932
Blocks: 1168310
TreeView+ depends on / blocked
Reported: 2014-11-27 15:08 UTC by Vasyl Kaigorodov
Modified: 2019-09-29 13:24 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was found that the X.Org server did not properly handle SUN-DES-1 (Secure RPC) authentication credentials. A malicious, unauthenticated client could use this flaw to crash the X.Org server by submitting a specially crafted authentication request.
Clone Of:
Last Closed: 2014-12-11 20:56:02 UTC

Attachments (Terms of Use)
0001-unchecked_malloc_may_allow_unauthed_client_to_crash_Xserver_CVE-2014-8091.patch (1.36 KB, text/plain)
2014-11-27 15:12 UTC, Vasyl Kaigorodov
no flags Details

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1982 normal SHIPPED_LIVE Important: xorg-x11-server security update 2014-12-11 22:34:45 UTC
Red Hat Product Errata RHSA-2014:1983 normal SHIPPED_LIVE Important: xorg-x11-server security update 2014-12-12 00:41:58 UTC

Description Vasyl Kaigorodov 2014-11-27 15:08:02 UTC
In servers built with support for SUN-DES-1 (Secure RPC)
authentication credentials, an unauthenticated client may be able to
crash the X server by sending a connection request specifying values
that cause malloc to fail, causing the authentication routines to
attempt to write data to the returned NULL pointer.  Since the request
is limited to an unsigned 16-bit integer for the allocation size, it is 
unlikely to fail unless the server is severely memory constrained.

Introduced in the initial revision of Secure RPC support in X11R5 (1991)

Comment 1 Vasyl Kaigorodov 2014-11-27 15:12:07 UTC
Created attachment 962110 [details]

Comment 2 Huzaifa S. Sidhpurwala 2014-12-05 05:19:50 UTC
This issue arises because Xorg server fails to check the return value from a malloc call. The size of data(len) to be malloced is set by the authenticated client. 

len is unsigned 16 bits (as per the X protocol, sent by the client), though the server casts it into a int.

So, successful exploitation will require malloc to fail when allocating a buffer of size UINT16_MAX

Comment 5 Vincent Danen 2014-12-09 20:12:52 UTC
External References:


Comment 6 errata-xmlrpc 2014-12-11 17:35:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:1982 https://rhn.redhat.com/errata/RHSA-2014-1982.html

Comment 7 errata-xmlrpc 2014-12-11 19:42:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2014:1983 https://rhn.redhat.com/errata/RHSA-2014-1983.html

Note You need to log in before you can comment on or make changes to this bug.