CVE-2023-0494: Use After Free
First published: Tue Jan 31 2023(Updated: )
A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/xorg-server | <21.1.7 | 21.1.7 |
| <21.1.7 | ||
| =36 | ||
| =37 | ||
| =8.0 | ||
| =8.1 | ||
| =9.0 | ||
| =8.4 | ||
| =8.6 | ||
| =7.0 | ||
| =8.4 | ||
| =8.6 | ||
| =9.0 | ||
| =7.0 | ||
| =8.0 | ||
| =8.4 | ||
| =8.6 | ||
| =7.0 | ||
| =7.0 | ||
| =8.0 | ||
| =9.0 | ||
| =8.4 | ||
| =8.6 | ||
| =7.0 | ||
| =7.0 | ||
| =8.2 | ||
| =8.1 | ||
| =8.2 | ||
| =8.4 | ||
| =8.6 | ||
| =9.0 | ||
| =8.2 | ||
| =8.4 | ||
| =8.6 | ||
| =8.2 | ||
| =7.0 | ||
| X Window System | <21.1.7 | |
| Fedora | =36 | |
| Fedora | =37 | |
| Red Hat Enterprise Linux | =8.0 | |
| Red Hat Enterprise Linux | =8.1 | |
| Red Hat Enterprise Linux | =9.0 | |
| Red Hat Enterprise Linux | =8.4 | |
| Red Hat Enterprise Linux | =8.6 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server EUS | =8.4 | |
| Red Hat Enterprise Linux Server EUS | =8.6 | |
| Red Hat Enterprise Linux Server EUS | =9.0 | |
| Red Hat Enterprise Linux for IBM Z Systems | =7.0 | |
| Red Hat Enterprise Linux for IBM Z Systems | =8.0 | |
| Red Hat Enterprise Linux for IBM Z Systems (s390x) | =8.4 | |
| Red Hat Enterprise Linux for IBM Z Systems (s390x) | =8.6 | |
| Red Hat Enterprise Linux for Power, big endian | =7.0 | |
| Red Hat Enterprise Linux for Power, little endian | =7.0 | |
| Red Hat Enterprise Linux for Power, little endian | =8.0 | |
| Red Hat Enterprise Linux for Power, little endian | =9.0 | |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | =8.4 | |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | =8.6 | |
| Red Hat Enterprise Linux for Scientific Computing | =7.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =8.2 | |
| Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support | =8.1 | |
| Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support | =8.2 | |
| Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support | =8.4 | |
| Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support | =8.6 | |
| Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support | =9.0 | |
| Red Hat Enterprise Linux Server | =8.2 | |
| Red Hat Enterprise Linux Server | =8.4 | |
| Red Hat Enterprise Linux Server | =8.6 | |
| Red Hat Enterprise Linux Server Update Services for SAP Solutions | =8.2 | |
| Red Hat Enterprise Linux Server Workstation | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2165995
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec
- https://lists.x.org/archives/xorg-announce/2023-February/003320.html
- https://security.gentoo.org/glsa/202305-30
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167568
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167569
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167566
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167567
- https://access.redhat.com/errata/RHSA-2023:0622
- https://access.redhat.com/errata/RHSA-2023:0623
- https://access.redhat.com/errata/RHSA-2023:0665
- https://access.redhat.com/errata/RHSA-2023:0664
- https://access.redhat.com/errata/RHSA-2023:0662
- https://access.redhat.com/errata/RHSA-2023:0663
- https://access.redhat.com/errata/RHSA-2023:0671
- https://access.redhat.com/errata/RHSA-2023:0675
- https://access.redhat.com/security/cve/cve-2023-0494
- https://access.redhat.com/errata/RHSA-2023:2248
- https://access.redhat.com/errata/RHSA-2023:2249
- https://access.redhat.com/errata/RHSA-2023:2805
- https://access.redhat.com/errata/RHSA-2023:2806
Frequently Asked Questions
What is the severity of CVE-2023-0494?
The severity of CVE-2023-0494 is high with a CVSS score of 7.8.
Which software is affected by CVE-2023-0494?
The software affected by CVE-2023-0494 includes X.Org X Server, xorg-server, and various versions of Fedora and Redhat Enterprise Linux.
How can CVE-2023-0494 be exploited?
CVE-2023-0494 can be exploited by using the ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() functions to read and write into freed memory, leading to local privilege elevation.
How can I fix CVE-2023-0494?
To fix CVE-2023-0494, update to version 21.1.7 of xorg-server.
Where can I find more information about CVE-2023-0494?
More information about CVE-2023-0494 can be found in the X.Org announcement and the Redhat bugzilla links provided.
- agent/type
- agent/first-publish-date
- agent/author
- agent/references
- agent/severity
- agent/remedy
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-0494
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/event
- package-manager/redhat
- vendor/x.org
- vendor/fedoraproject
- vendor/redhat
- canonical/x window system
- canonical/fedora
- version/fedora/36
- version/fedora/37
- canonical/red hat enterprise linux
- version/red hat enterprise linux/8.0
- version/red hat enterprise linux/8.1
- version/red hat enterprise linux/9.0
- version/red hat enterprise linux/8.4
- version/red hat enterprise linux/8.6
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server eus
- version/red hat enterprise linux server eus/8.4
- version/red hat enterprise linux server eus/8.6
- version/red hat enterprise linux server eus/9.0
- canonical/red hat enterprise linux for ibm z systems
- version/red hat enterprise linux for ibm z systems/7.0
- version/red hat enterprise linux for ibm z systems/8.0
- canonical/red hat enterprise linux for ibm z systems (s390x)
- version/red hat enterprise linux for ibm z systems (s390x)/8.4
- version/red hat enterprise linux for ibm z systems (s390x)/8.6
- canonical/red hat enterprise linux for power, big endian
- version/red hat enterprise linux for power, big endian/7.0
- canonical/red hat enterprise linux for power, little endian
- version/red hat enterprise linux for power, little endian/7.0
- version/red hat enterprise linux for power, little endian/8.0
- version/red hat enterprise linux for power, little endian/9.0
- canonical/red hat enterprise linux for power, little endian - extended update support
- version/red hat enterprise linux for power, little endian - extended update support/8.4
- version/red hat enterprise linux for power, little endian - extended update support/8.6
- canonical/red hat enterprise linux for scientific computing
- version/red hat enterprise linux for scientific computing/7.0
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/8.2
- canonical/red hat enterprise linux for sap applications for power, little endian - extended update support
- version/red hat enterprise linux for sap applications for power, little endian - extended update support/8.1
- version/red hat enterprise linux for sap applications for power, little endian - extended update support/8.2
- version/red hat enterprise linux for sap applications for power, little endian - extended update support/8.4
- version/red hat enterprise linux for sap applications for power, little endian - extended update support/8.6
- version/red hat enterprise linux for sap applications for power, little endian - extended update support/9.0
- version/red hat enterprise linux server/8.4
- version/red hat enterprise linux server/8.6
- canonical/red hat enterprise linux server update services for sap solutions
- version/red hat enterprise linux server update services for sap solutions/8.2
- canonical/red hat enterprise linux server workstation
- version/red hat enterprise linux server workstation/7.0