Memory Corruption Vulnerability in libX11 by X.Org

CVE-2023-3138

What is CVE-2023-3138?

A vulnerability in libX11 arises when functions within src/InitExt.c do not validate the bounds of Request, Event, or Error IDs. This oversight allows potentially malicious inputs to corrupt memory regions, leading to application crashes. The vulnerability exploits the reliance on X servers to adhere to the X11 protocol, allowing a malicious server or proxy to provide out-of-bounds values. While the protocol restricts these values to a single byte, the absence of adequate validation can cause overwriting within the Display structure, thereby compromising system stability.

References