xorg-x11-server-Xwayland-21.1.3-16.el8

エラータID: AXSA:2024-8340:03

Release date: 
Tuesday, June 18, 2024 - 15:56
Subject: 
xorg-x11-server-Xwayland-21.1.3-16.el8
Affected Channels: 
Asianux Server 8 for x86_64
Severity: 
High
Description: 

Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080)
* xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081)
* xorg-x11-server: Use-after-free in ProcRenderAddGlyphs (CVE-2024-31083)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

CVE-2024-31080
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.
CVE-2024-31081
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.
CVE-2024-31083
A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. xorg-x11-server-Xwayland-21.1.3-16.el8.src.rpm
    MD5: b43942ccc23f5328dd6926b4800989f7
    SHA-256: c17da41cf1283bedcbe5ecbb055e11a64bb36dcf75be03306d8534092f0abaa4
    Size: 1.25 MB

Asianux Server 8 for x86_64
  1. xorg-x11-server-Xwayland-21.1.3-16.el8.x86_64.rpm
    MD5: 89d4f6418084e55a312b5cb6c78c6762
    SHA-256: 41d623cfab7d7a5abcade0c9f77e63265c044da75c80f888abc8e180c73eac8f
    Size: 965.54 kB