{"id":112179,"date":"2023-12-13T09:10:17","date_gmt":"2023-12-13T07:10:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-10-s-ustraneniem-uyazvimostej-udalenie-podderzhki-ums-iz-yadra-linux"},"modified":"2023-12-13T09:10:17","modified_gmt":"2023-12-13T07:10:17","slug":"obnovlenie-x-org-server-21-1-10-s-ustraneniem-uyazvimostej-udalenie-podderzhki-ums-iz-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-x-org-server-21-1-10-s-ustraneniem-uyazvimostej-udalenie-podderzhki-ums-iz-yadra-linux","title":{"rendered":"Updated X.Org Server 21.1.10 with vulnerability fixes. Removed UMS support from the Linux kernel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases X.Org Server 21.1.10 and the DDX component (Device-Dependent X) xwayland 23.2.3 have been published, enabling the launch of the X.Org Server to run X11 applications in Wayland-based environments. The new versions address two vulnerabilities. The first vulnerability can be exploited for privilege escalation on systems where the X server runs with root permissions, as well as for remote code execution in configurations that use SSH for X11 session forwarding. <\/p>\n
Identified issues: <\/p>\n
\n
CVE-2023-6377 \u2014 buffer overflow in the XKB button handler occurring when switching logical input devices (e.g., switching from touchpad to mouse) due to incorrect calculation of device information. The X server allocated memory sufficient only for the handler of a single XKB button, failing to account for the actual number of buttons on the new device. Consequently, the request to change the XKB button handlers resulted in writing data outside the buffer. The issue has existed since the release of xorg-server-1.6.0 (2009).\n
CVE-2023-6478 \u2014 integer overflow occurring when sending specially crafted requests to RRChangeProviderProperty and RRChangeOutputProperty. This vulnerability can lead to reading data from outside the buffer and leaking information from the process memory. The problem is caused by the use of a 32-bit int type in a variable for size calculation, which can overflow when a large request is sent. Issues have been present since the releases of xorg-server-1.4.0 (2004) and xorg-server-1.13.0 (2012). <\/ul>\n
Additionally, there is a request to remove ioctl calls supported by UMS (Userspace Mode-Setting) from the linux-next branch, which is developing changes for Linux kernel 6.8. The UMS interface is intended for switching video modes at the user level and was used in very old drivers that are no longer supported. UMS-supporting drivers were deprecated in 2016 and removed in kernel release 6.3. <\/p>\n
Specifically, in kernel 6.3, drivers for i810 (old integrated Intel 8xx graphics cards), mga (Matrox GPU), r128 (ATI Rage 128 GPU, including Rage Fury, XPERT 99, and XPERT 128 cards), savage (S3 Savage GPU), sis (Crusty SiS GPU), tdfx (3dfx Voodoo), and via (VIA IGP) were removed. Since there have been no requests for their return since the removal of these drivers, it has been decided to remove the UMS infrastructure elements used in these drivers from the DRM subsystem in kernel 6.8. The relevant drivers have long transitioned to video mode switching via the KMS (Kernel Mode Setting) interface. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"