Dangling Pointer Vulnerability in X.Org Leading to Local Privilege Escalation and Remote Code Execution

CVE-2023-0494

What is CVE-2023-0494?

A vulnerability exists within X.Org due to a dangling pointer in the DeepCopyPointerClasses function. This flaw allows attackers to exploit methods such as ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to manipulate freed memory. As a result, this could enable local privilege elevation on systems where the X server is run with elevated privileges, as well as potential remote code execution through SSH X forwarding sessions. Users are encouraged to update to patched versions to mitigate these risks and enhance their system's security.

References