CVE-2024-31083 — Use After Free in Xorg-server

CWE-416 — Use After Free14 documents10 sources
Severity
7.8HIGHNVD
OSV7.3
EPSS
0.1%
top 72.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
X.org Xorg-serverX.org Xwayland
Timeline
PublishedApr 5
Latest updateApr 9

Description

A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶Debianx.org/xorg-server< 2:1.20.11-1+deb11u13+3
▶Ubuntux.org/xorg-server< 2:1.20.13-1ubuntu1~20.04.16+4
▶Debianx.org/xwayland< 2:23.2.6-1+1
▶Ubuntux.org/xwayland< 2:22.1.1-1ubuntu0.12

🔴Vulnerability Details

5
OSV
xorg-server, xwayland regression↗2024-04-09
▶
CVEList
Xorg-x11-server: use-after-free in procrenderaddglyphs↗2024-04-05
▶
OSV
CVE-2024-31083: A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers↗2024-04-05
▶
GHSA
GHSA-q6w6-rjjj-5p52: A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers↗2024-04-05
▶
OSV
xorg-server, xwayland vulnerabilities↗2024-04-04
▶

📋Vendor Advisories

7
Microsoft
Xorg-x11-server: use-after-free in procrenderaddglyphs↗2024-04-09
▶
BSD
OpenBSD 7.4 Errata 016: SECURITY FIX↗2024-04-08
▶
BSD
OpenBSD 7.5 Errata 001: SECURITY FIX↗2024-04-08
▶
BSD
OpenBSD 7.3 Errata 028: SECURITY FIX↗2024-04-08
▶
Ubuntu
X.Org X Server vulnerabilities↗2024-04-04
▶

💬Community

1
Bugzilla
CVE-2023-31083 kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl↗2023-06-07
▶
CVE-2024-31083 — Use After Free in X.org Xorg-server | cvebase