CVE-2023-3138: Buffer Overflow
A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.
Other sources
The functions in src/InitExt.c in libX11 prior to 1.8.6 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. Instead they trusted that they were called with values provided by an Xserver that was adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do.
As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself. Testing has found it is possible to at least cause the client to crash with this memory corruption.
This is fixed in: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/TBD which is included in the libX11 1.8.6 release issued today.
X.Org thanks Gregory James Duck for reporting this issue to our security team.
— Red Hat
X.Org libX11 is vulnerable to a denial of service, caused by a buffer overflow in the functions in src/InitExt.c. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libX11to a version that resolves this vulnerability.Fixed in 1.8.6 - Upgrade
Upgrade
libX11to a version that resolves this vulnerability.Fixed in 1.8.6
Event History
Frequently Asked Questions
What is CVE-2023-3138?
CVE-2023-3138 is a vulnerability found in libX11 that allows attackers to write arbitrary values to arrays, potentially leading to remote code execution or denial of service.
How does the vulnerability in libX11 (CVE-2023-3138) occur?
The vulnerability occurs because certain functions in src/InitExt.c in libX11 do not properly check the bounds of array indexes.
What is the severity rating of CVE-2023-3138?
CVE-2023-3138 has a severity rating of 7.5 (High).
Which software versions are affected by CVE-2023-3138?
X.Org libX11 versions up to 1.8.6, Redhat Enterprise Linux 8.0, and Redhat Enterprise Linux 9.0 are affected by CVE-2023-3138.
How can I fix the vulnerability in libX11 (CVE-2023-3138)?
To fix the vulnerability, it is recommended to update to a patched version of libX11 as provided by the vendor or project maintainers.