REDHAT-BUG-2509620: High severity X.Org libXfont2 vulnerability
fsreadglyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two values are never cross-checked, so a malicious font server can send a small numextents (e.g. 1) followed by a large numchars (e.g. 100000) to cause out-of-bounds heap reads via NONZEROMETRICS(&encoding[minchar].metrics) and out-of-bounds writes of a heap pointer via encoding[minchar].bits = bits. When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of service (crash). This is caused by an incomplete fix of CVE-2014-0210.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
The attacker needs to operate or control a font server that the affected X server contacts. The malicious server can return inconsistent FS_QueryXExtents16 and FS_QueryXBitmaps16 reply counts to trigger the out-of-bounds accesses.
How does the impact depend on the X server's privileges?
An X server running as root can be exposed to privilege escalation. If the X server runs as an unprivileged user, the documented impact is a denial of service through a crash.
Is the earlier CVE-2014-0210 fix sufficient?
No. This issue is described as resulting from an incomplete fix for CVE-2014-0210.