Xorg-x11-server: heap buffer overread/data leakage in procxipassivegrabdevice

CVE-2024-31081

Summary

A heap-based buffer over-read vulnerability exists in the X.org server's ProcXIPassiveGrabDevice() function. This vulnerability arises when byte-swapped length values are utilized in replies, which can create memory leakage scenarios and lead to segmentation faults. Specifically, this issue may be triggered by clients operating with differing endianness, allowing an attacker to exploit the X server's ability to read heap memory values and subsequently transmit them back to the client, potentially leading to a crash when an unmapped page is accessed. Although the attacker cannot dictate the precise memory content copied into the replies, small length values, typically represented as 32-bit integers, can prompt significant out-of-bounds read attempts.

References