CVE-2023-3138
Description
A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.
Statement
The identified security vulnerability in the libX11 library, categorized with a moderate impact, stems from a lack of bounds checking in certain functions within the library's InitExt.c file. Specifically, these functions do not verify that the values provided for Request, Event, or Error IDs fall within the bounds specified by the X11 protocol. Consequently, if a malicious X server or intermediary manipulates these values, it can trigger memory corruption within the client's Display structure. While this can lead to crashes or instability within the client application, the impact is constrained within the client's memory space and does not directly compromise sensitive data or system resources beyond it. The vulnerability requires specific conditions, such as interaction with a malicious server or intermediary, which limits its practical exploitability.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.3 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | None | N/A |
| User Interaction | Required | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | High | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat CVSS v3 Score Explanation
This vulnerability arises due to the absence of bounds checking in the functions responsible for writing to arrays using these IDs as indexes. Exploiting this flaw requires low privileges (PR:L) and user interaction (UI:R), as an attacker could craft malicious input, potentially through a compromised server or proxy, triggering memory corruption. While the X11 protocol specifies single-byte values for these IDs, an out-of-bounds value could overwrite adjacent memory areas within the Display structure, leading to severe consequences (I:H) such as system crashes or unauthorized access to sensitive data.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
