Corrective releases X.Org Server 21.1.10 and the DDX component (Device-Dependent X) xwayland 23.2.3 have been published, enabling the launch of the X.Org Server to run X11 applications in Wayland-based environments. The new versions address two vulnerabilities. The first vulnerability can be exploited for privilege escalation on systems where the X server runs with root permissions, as well as for remote code execution in configurations that use SSH for X11 session forwarding.
Identified issues:
- CVE-2023-6377 — a buffer overflow in the XKB button handler that occurs when switching logical input devices (e.g., transitioning from a touchpad to a mouse) due to incorrect device information calculations. The X server allocated memory only sufficient for handling one XKB button without considering the actual number of buttons on the new device. Consequently, a request to change XKB button handlers led to data being written outside the buffer. The issue has been present since the xorg-server-1.6.0 release (2009).
- CVE-2023-6478 — an integer overflow that occurs when sending specially crafted RRChangeProviderProperty and RRChangeOutputProperty requests. The vulnerability can lead to reading data from outside the buffer and leaking information from the process's memory. This issue is caused by using a 32-bit int type in a variable for size calculation, which can overflow when transmitting a large request. The problems have been observed since xorg-server versions 1.4.0 (2004) and 1.13.0 (2012).
Additionally, there is a request to remove ioctl calls supported by UMS (Userspace Mode-Setting) from the linux-next branch, which is developing changes for Linux kernel 6.8. The UMS interface is intended for switching video modes at the user level and was used in very old drivers that are no longer supported. UMS-supporting drivers were deprecated in 2016 and removed in kernel release 6.3.
Specifically, in kernel 6.3, drivers for i810 (old integrated Intel 8xx graphics cards), mga (Matrox GPU), r128 (ATI Rage 128 GPU, including Rage Fury, XPERT 99, and XPERT 128 cards), savage (S3 Savage GPU), sis (Crusty SiS GPU), tdfx (3dfx Voodoo), and via (VIA IGP) were removed. Since there have been no requests for their return since the removal of these drivers, it has been decided to remove the UMS infrastructure elements used in these drivers from the DRM subsystem in kernel 6.8. The relevant drivers have long transitioned to video mode switching via the KMS (Kernel Mode Setting) interface.
Source: opennet.ru
