CVE-2024-21886: Xorg-x11-server: heap buffer overflow in disabledevice
A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments.
Other sources
Xorg-x11-server: heap buffer overflow in disabledevice
— Microsoft
ZDI-CAN-22840 - VULNERABILITY DETAILS Version tested:1.21.1.7 Installer file:- Platform tested:debian-live-12.2.0-amd64-xfce.iso
Analysis
The exploit doesn't work if the OS installed on vmware and default virtualbox it works on virtualbox with VBoxVGA graphic controller
DisableDevice() function is called whenever an enabled device is disabled. However, its link/unlink operation has issue during the recursive call to DisableDevice(). It leads to the length mismatch between the total number of device and the number of device in the list. Then, it leads to heap overflow and LPE for some distribution (xorg in debian xfce is run as root under specific display driver) and RCE for sshx11 forwarding environment.
Reference: https://gitlab.freedesktop.org/xorg/xserver/-/blob/8cce7f5d64d4f1027801892631b65b2c859cc559/dix/devices.c#L449
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21886?
CVE-2024-21886 is categorized as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2024-21886?
To fix CVE-2024-21886, update the xorg-server to version 21.1.11 or xwayland to version 23.2.4 for Red Hat systems, or the relevant patched versions for Debian.
What causes the CVE-2024-21886 vulnerability?
CVE-2024-21886 is caused by a heap buffer overflow in the DisableDevice function within the X.Org server.
Can CVE-2024-21886 lead to application crashes?
Yes, CVE-2024-21886 can cause application crashes in addition to potentially enabling remote code execution in specific environments.
Is CVE-2024-21886 present in all versions of X.Org server?
No, CVE-2024-21886 affects specific versions of the xorg-server and xwayland packages, especially older versions prior to the recommended updates.