CVE-2023-6816
Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.
Se encontró un fallo en el servidor X.Org. Tanto DeviceFocusEvent como la respuesta de XIQueryPointer contienen un bit para cada botón lógico actualmente presionado. Los botones se pueden asignar arbitrariamente a cualquier valor hasta 255, pero el servidor X.Org solo asignaba espacio para la cantidad particular de botones del dispositivo, lo que provocaba un desbordamiento de búfer en la región Heap de la memoria si se usaba un valor mayor.
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of SetInputFocus requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-12-14 CVE Reserved
- 2024-01-17 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (22)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2024/01/18/1 | 2024-05-22 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2024:0320 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:0557 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:0558 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:0597 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:0607 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:0614 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:0617 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:0621 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:0626 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:0629 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:2169 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:2170 | 2024-05-22 | |
| https://access.redhat.com/errata/RHSA-2024:2996 | 2024-05-22 | |
| https://access.redhat.com/security/cve/CVE-2023-6816 | 2024-05-22 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2257691 | 2024-05-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| X.org Search vendor "X.org" | Xorg-server Search vendor "X.org" for product "Xorg-server" | < 21.1.11 Search vendor "X.org" for product "Xorg-server" and version " < 21.1.11" | - |
Affected
| ||||||
| X.org Search vendor "X.org" | Xwayland Search vendor "X.org" for product "Xwayland" | < 23.2.4 Search vendor "X.org" for product "Xwayland" and version " < 23.2.4" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 39 Search vendor "Fedoraproject" for product "Fedora" and version "39" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "7.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||