PT-2021-17196 · Xcb · Xcb

Published 2021-02-04 · Updated 2021-08-25 · CVE-2021-26955

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: xcb crate versions through 2021-02-04

Description: The issue concerns a soundness violation in the xcb crate for Rust, where several functions handle data from an X server without proper validation or type constraints. Specifically, xcb::xproto::GetAtomNameReply::name() calls std::str::from utf8 unchecked() on unvalidated bytes, and xcb::xproto::GetPropertyReply::value() returns a slice of an unconstrained type parameter, interpreting raw bytes as the requested type. Additionally, xcb::xproto::change property() has an out-of-bounds read when the format and type arguments do not match the intended use cases. The xcb::base::cast event() function also uses std::mem::transmute() without constraining the return type, potentially leading to transmutation to an incorrect type. Users are advised to use these functions with caution and only with the intended types to minimize risks.

Recommendations: For versions through 2021-02-04, consider the following:

• When using xcb::xproto::GetAtomNameReply::name(), ensure that the bytes received from the X server are validated before calling std::str::from utf8 unchecked().
• When using xcb::xproto::GetPropertyReply::value(), only call this function with the intended types, which are u8, u16, and u32.
• When using xcb::xproto::change property(), ensure that the format and type arguments match the intended use cases to avoid out-of-bounds reads.
• When using xcb::base::cast event(), only cast to the event structs provided by the xcb crate to minimize the risk of transmutation to an incorrect type. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Unchecked Return Value

Weakness Enumeration

CWE-125

CWE-252

CWE-657

Related Identifiers

CVE-2021-26955

GHSA-2XPG-3HX4-FM9R

GHSA-3288-CWGW-CH86

GHSA-3CJ3-JRRP-9RXF

GHSA-MP6R-FGW2-RXFX

RUSTSEC-2021-0019

Affected Products

Xcb

References · 25

• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0019.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-26955 · Security Note
• https://osv.dev/vulnerability/GHSA-3cj3-jrrp-9rxf · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-26955 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0019 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3288-cwgw-ch86 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26956 · Security Note
• https://osv.dev/vulnerability/GHSA-mp6r-fgw2-rxfx · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-26955 · Security Note
• https://osv.dev/vulnerability/GHSA-2xpg-3hx4-fm9r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26957 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26955 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-26955 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26958 · Security Note