Corrective releases of X.Org Server 21.1.9 and the DDX component (Device-Dependent X) xwayland 22.2.2 have been published, enabling the launch of X.Org Server for executing X11 applications in Wayland-based environments. The new versions fix vulnerabilities that could potentially be exploited for privilege escalation in systems where the X server runs with root privileges, as well as for remote code execution in configurations using X11 session forwarding via SSH.
Identified issues:
- CVE-2023-5367 — buffer overflow in the XIChangeDeviceProperty and RRChangeOutputProperty functions, which can be exploited by attaching additional items to an input device's property or a randr property. This vulnerability has existed since xorg-server version 1.4.0 (2007) and is caused by an incorrect offset calculation when attaching additional items to existing properties, resulting in items being added with an incorrect offset, leading to out-of-bounds memory write. For example, when attaching 3 items to 5 existing items, memory for an array of 8 items will be allocated, but the previously existing items will be stored in the new array starting from index 5 instead of 3, which will result in the last two items being written outside the buffer.
- CVE-2023-5380 — use-after-free vulnerability in the DestroyWindow function. This issue can be exploited by moving the pointer between screens in multi-monitor configurations in zaphod mode, where each monitor has its own screen, and calling the function to close a client window. The vulnerability has existed since xorg-server version 1.7.0 (2009) and is caused by the fact that after a window is closed and its associated memory is freed, an active pointer to the previous window remains in the structure that binds to the screen. Xwayland is not affected by this vulnerability.
- CVE-2023-5574 — use-after-free vulnerability in the DamageDestroy function. This vulnerability can be exploited in server Xvfb is clearing the structure ScreenRec during the server shutdown or disconnection of the last client. Like the previous vulnerability, the issue only manifests in multi-monitor configurations in Zaphod mode. The vulnerability has been present since the release of xorg-server-1.13.0 (2012) and remains unpatched (fix only available as a patch).
In addition to fixing vulnerabilities in xwayland 23.2.2, there has also been a transition from the libbsd-overlay library to libbsd, and automatic connection to the RemoteDesktop XDG Desktop Portal interface for determining the socket used for sending XTest events has been discontinued. The automatic connection created problems when starting xwayland in a nested composite server, so in the new version, the option "-enable-ei-portal" must be explicitly specified for connecting to the portal. server Firefox 119 Release
Source: opennet.ru
