CVE-2024-0409

2024-01-1816:15:08

Alpine Linux Development Team

security.alpinelinux.org

x.org

server

cursor

xephyr

xwayland

private

xselinux

unix

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

OSVersionArchitecturePackageVersionFilename
Alpineedge-communitynoarchxorg-server< 21.1.11-r0UNKNOWN
Alpineedge-communitynoarchxwayland< 23.2.4-r0UNKNOWN
Alpine3.19-communitynoarchxorg-server< 21.1.11-r0UNKNOWN
Alpine3.19-communitynoarchxwayland< 23.2.4-r0UNKNOWN
Alpine3.20-communitynoarchxorg-server< 21.1.11-r0UNKNOWN
Alpine3.20-communitynoarchxwayland< 23.2.4-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-community	noarch	xorg-server	< 21.1.11-r0	UNKNOWN
Alpine	edge-community	noarch	xwayland	< 23.2.4-r0	UNKNOWN
Alpine	3.19-community	noarch	xorg-server	< 21.1.11-r0	UNKNOWN
Alpine	3.19-community	noarch	xwayland	< 23.2.4-r0	UNKNOWN
Alpine	3.20-community	noarch	xorg-server	< 21.1.11-r0	UNKNOWN
Alpine	3.20-community	noarch	xwayland	< 23.2.4-r0	UNKNOWN