Use-After-Free Vulnerability in X.Org Server Overlay Window by X.Org Foundation
CVE-2023-1393

7.8HIGH

Key Information:

Vendor

X.org

Status
Xorg-server
Vendor
CVE Published:
30 March 2023

What is CVE-2023-1393?

A vulnerability exists in the X.Org Server's handling of overlay windows, which can lead to a use-after-free condition. This occurs when a client destroys a compositor overlay window, resulting in the Xserver retaining a dangling pointer to that window within the CompScreen structure. If this pointer is used afterward, it may allow for local privilege escalation, enabling unauthorized access to system resources.

Affected Version(s)

xorg-server xorg-server 21.1.8

References

https://www.openwall.com/lists/oss-security/2023/03/29/1
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.