PT-2024-2937 · Unknown+11 · Xorg-Server+11
Tej Rathi
·
Published
2024-03-04
·
Updated
2025-03-17
·
CVE-2024-31081
CVSS v3.1
7.3
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
Xorg-server (affected versions not specified)
Description
The issue is related to a heap-based buffer over-read vulnerability in the ProcXIPassiveGrabDevice() function of the Xorg-server. This vulnerability occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, especially when triggered by a client with a different endianness. An attacker could exploit this to cause the X server to read heap memory values and transmit them back to the client until encountering an unmapped page, resulting in a crash. Although the attacker cannot control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Buffer Over-read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Xorg-Server