CVE-2023-5574

Summary

A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

Affected Software

Weaknesses

• CWE-416: Use After Free

Workarounds

Starting Xvfb with the -noreset command line option limits the use-after-free from being triggered only at the Xvfb server shutdown. Also, do not start Xvfb as root.

ADP Enrichment

CVE Program Container

Additional References

• https://access.redhat.com/errata/RHSA-2024:2298
• https://access.redhat.com/security/cve/CVE-2023-5574
• https://bugzilla.redhat.com/show_bug.cgi?id=2244735
• https://lists.x.org/archives/xorg-announce/2023-October/003430.html
• https://security.netapp.com/advisory/ntap-20231130-0004/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://access.redhat.com/errata/RHSA-2024:2298
• https://access.redhat.com/security/cve/CVE-2023-5574
• https://bugzilla.redhat.com/show_bug.cgi?id=2244735
• https://lists.x.org/archives/xorg-announce/2023-October/003430.html

• ←Previous
• Next→