CVE-2024-9632: Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability
A flaw was found in the X.org server. Due to improperly tracked allocation size in XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org server is run with root privileges.
Other sources
The XkbSetCompatMap() function attempts to resize the syminterpret buffer. However, it didn't update its size properly. It updated numsi only, without sizesi: https://gitlab.freedesktop.org/xorg/xserver/-/blob/cdb4d5648a818a8e8ab282341be37109589229ab/xkb/xkb.c#L2998
The exploit uses bitmap to achieve the arbitrary read and write. It leads to LPE for some distributions (xorg in debian xfce is run as root under specific display driver) and RCE for ssh x11 forwarding environment.
The exploit doesn't work if the OS installed on vmware and default virtualbox. It works on virtualbox with VBoxVGA graphic controller.
— Red Hat
Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9632?
CVE-2024-9632 has a high severity due to the potential for a buffer overflow that can be exploited by a local attacker.
How do I fix CVE-2024-9632?
To fix CVE-2024-9632, upgrade to the latest versions of xorg-server or xwayland that have addressed this vulnerability.
What software is affected by CVE-2024-9632?
CVE-2024-9632 affects the xorg-server and xwayland packages on Debian systems.
What type of vulnerability is CVE-2024-9632?
CVE-2024-9632 is classified as a buffer overflow vulnerability.
Can CVE-2024-9632 be exploited remotely?
CVE-2024-9632 requires local access for exploitation, making it less of a risk for remote attacks.