REDHAT-BUG-2509622: Buffer Overflow
fsreadglyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap data into a single allbits buffer allocated to rep->nbytes bytes. The per-glyph validation checks only that each source slice (position, length) lies within the source bitmap buffer, but never checks whether the cumulative destination writes exceed the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64) so that each individual source range passes validation, but the cumulative writes total 64000 bytes into a 64-byte heap buffer. This is a heap buffer overflow with attacker-controlled content and size. When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of service (crash).
This is caused by an incomplete fix of CVE-2014-0210.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker who can operate or control a font server used by the vulnerable libXfont2 font-server client can supply crafted glyph data. The attacker needs to send glyph records whose individual source ranges are valid but whose combined copied lengths exceed the allocated destination buffer.
What is the impact on systems running the X server?
A successful exploit causes a heap buffer overflow with attacker-controlled content and size. If the X server runs as root, the issue can lead to privilege escalation; if it runs as an unprivileged user, it can cause a crash and denial of service.
Is the issue limited to malformed glyph data that is out of bounds in the source buffer?
No. Each glyph's source position and length can remain within the source bitmap buffer. Exploitation relies on overlapping source offsets or similar records that make the total amount copied into the single allbits buffer exceed rep->nbytes.