CVE-2023-5574: Xorg-x11-server: use-after-free bug in damagedestroy
A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
Other sources
Merge request tracking the fixes: https://gitlab.freedesktop.org/xorg/xserver/-/mergerequests/1189
This issue only affects Xvfb and requires a legacy multi-screen setup with multiple protocol screens ("Zaphod").
Screen cleanup is handled via stackable "modules", but the fb module hardcoded the cleanup path for the screen pixmap instead of calling into the next layer of the stack. This caused a minor memory leak that was fixed with a patch to Xvfb introduced in server 1.13. However, that patch did not remove all references to the freed pixmap, causing a use-after-free during screen cleanup in a lower module.
This issue has not yet been fixed, please see the above merge request to track future fixes to this issue.
Reference: https://lists.x.org/archives/xorg-announce/2023-October/003430.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/xorg-serverto a version that resolves this vulnerability.Fixed in 21.1.9
Event History
Frequently Asked Questions
What is CVE-2023-5574?
CVE-2023-5574 is a use-after-free vulnerability found in xorg-x11-server-Xvfb.
What is the severity of CVE-2023-5574?
CVE-2023-5574 has a severity level of high (7).
How does CVE-2023-5574 affect xorg-x11-server-Xvfb?
CVE-2023-5574 affects xorg-x11-server-Xvfb with a very specific and legacy configuration (multi-screen setup with multiple protocol screens).
How do I fix CVE-2023-5574 in xorg-x11-server-Xvfb?
To fix CVE-2023-5574 in xorg-x11-server-Xvfb, update to version 21.1.9 or later.
Where can I find more information about CVE-2023-5574?
You can find more information about CVE-2023-5574 at the following references: [link1](https://access.redhat.com/security/cve/CVE-2023-5574), [link2](https://bugzilla.redhat.com/show_bug.cgi?id=2244735), [link3](https://lists.x.org/archives/xorg-announce/2023-October/003430.html).