CVE-2023-6478: Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty
A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.
Other sources
CVE-2023-6478: X.Org server: Out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
Introduced in: xorg-server-1.4.0 (2007) and xorg-server-1.13.0 (2012), respectively Fixed in: xorg-server-21.1.10 and xwayland-23.2.3 Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
This fixes an OOB read and the resulting information disclosure.
Length calculation for the request was clipped to a 32-bit integer. With the correct stuff->nUnits value the expected request size was truncated, passing the REQUESTFIXEDSIZE check.
The server then proceeded with reading at least stuff->nUnits bytes (depending on stuff->format) from the request and stuffing whatever it finds into the property. In the process it would also allocate at least stuff->nUnits bytes, i.e. 4GB.
See also CVE-2022-46344 where this issue was fixed for other requests.
xorg-server-21.1.10 and xwayland-23.2.3 have been patched to fix this issue.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:1.20.11-1+deb11u13Fixed in 2:1.20.11-1+deb11u15Fixed in 2:21.1.7-3+deb12u9Fixed in 2:21.1.16-1 - Upgrade
Upgrade
debian/xwaylandto a version that resolves this vulnerability.Fixed in 2:24.1.6-1 - Upgrade
Upgrade
redhat/xorg-serverto a version that resolves this vulnerability.Fixed in 21.1.10 - Upgrade
Upgrade
redhat/xwaylandto a version that resolves this vulnerability.Fixed in 23.2.3 - Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:1.20.11-1+deb11u13 - Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:1.20.11-1+deb11u15 - Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:21.1.7-3+deb12u9 - Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:21.1.16-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6478?
CVE-2023-6478 is classified as a medium-severity vulnerability due to the potential for sensitive information disclosure.
How do I fix CVE-2023-6478?
To fix CVE-2023-6478, update to the appropriate patched versions of xorg-server or xwayland as specified in the vendor advisories.
Which versions of xorg-server are affected by CVE-2023-6478?
Versions of xorg-server up to 21.1.10 are affected by CVE-2023-6478.
What is the nature of the vulnerability in CVE-2023-6478?
CVE-2023-6478 involves an integer overflow that can lead to an out-of-bounds memory read, potentially disclosing sensitive information.
Are there specific distributions impacted by CVE-2023-6478?
Yes, CVE-2023-6478 impacts several distributions including specific versions of Red Hat Enterprise Linux and Debian.