Amazon Linux 2 : xorg-x11-server (ALAS-2026-4014)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2026-4014.
##

include('compat.inc');

if (description)
{
  script_id(371756);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/24");

  script_cve_id(
    "CVE-2026-88812",
    "CVE-2026-93515",
    "CVE-2026-93516",
    "CVE-2026-93517",
    "CVE-2026-93518",
    "CVE-2026-93519",
    "CVE-2026-93521",
    "CVE-2026-93523",
    "CVE-2026-93524"
  );

  script_name(english:"Amazon Linux 2 : xorg-x11-server (ALAS-2026-4014)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4014 advisory.

    CheckSetDoodad() in xkb/xkb.c frees doodad->text.text on error but doesnot NULL the pointer. When the
    error path continues, _XkbClearDoodad() iscalled during cleanup and frees the same pointer again,
    resulting in adouble free.An authenticated X client can trigger this by sending a crafted XkbSetGeometry
    request with a malformed TextDoodad entry that causes the initial error path to be taken.

    The double free can lead to heap corruption, potentially enabling arbitrary code execution or denial of
    service (crash).

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-
    server-21.1.25) (CVE-2026-88812)

    Present_clear_window_notifies() does not unlink notify entries from the per-window list before freeing
    window_priv. When the window is subsequently destroyed or reused, the stale list entries are traversed,
    resulting in a use-after-free.

    An authenticated X client can trigger this by creating cross-window Present notifies and then destroying
    the target window. Both the Present and SYNC extensions must be enabled (they are by default).The use-
    after-free can lead to denial of service (crash) or potentially information disclosure.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/a469f98bcfab50dab607ff5ac24037632b0079a3 (xorg-
    server-21.1.25) (CVE-2026-93515)

    XInput Passive Grab modifierDevice Use-After-Free

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/9442a53c137bb9eb61336c6fd39627912d50cc8d (xorg-
    server-21.1.25) (CVE-2026-93516)

    In the GLX RenderLarge request handling, the buffer is allocated to the size of cmdlen but the subsequent
    memcpy copies dataBytes into it. There is no validation that dataBytes is less than or equal to cmdlen,
    allowing an attacker to write past the end of the allocated buffer.

    An authenticated X client can trigger this by sending a crafted GLX RenderLarge request where dataBytes
    exceeds cmdlen, causing a  heap buffer overflow.The heap buffer overflow can lead to arbitrary code
    execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/3961cdca467975a7d377f1f7bcd55d52eb3f417a (xorg-
    server-21.1.25) (CVE-2026-93517)

    In XkbResizeKeyType(), the size_syms variable is declared as unsigned short. The expression (nTotal * 15)
    / 10 can exceed 65535 for large nTotal values, and the result is truncated when assigned to the unsigned
    short variable. This causes an undersized allocation, and subsequent writes overflow the heap buffer.

    An authenticated X client can trigger this by sending XKB requests that cause a key type resize with a
    sufficiently large nTotal value.The heap buffer overflow resulting from the truncated allocation can lead
    to arbitrary code execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/558ba8f784b0f5d4d96948051b2f04c983af20cc (xorg-
    server-21.1.25) (CVE-2026-93518)

    Input_constrain_cursor() writes barrier events into a fixed-size buffer without checking bounds. When more
    than 100 pointer barriers are active, the writes overflow the fixed buffer on the stack or heap. An
    authenticated X client can trigger this by creating more than 100 pointer barriers (using the XFIXES
    extension) and then generating pointer motion events (e.g. via XTEST). Both extensions are enabled by
    default.

    The buffer overflow can lead to arbitrary code execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/9c3880d0745acefc98ed37e79498dfbe558a0f40 (xorg-
    server-21.1.25) (CVE-2026-93519)

    In RRChangeProviderProperty() with PrependMode, new_value.size is set to len instead of total_len.
    Additionally, the old_data offset calculation uses prop_value->size instead of len for the memcpy of
    existing data. This causes a heap buffer overflow when prepending property data, as the buffer is
    undersized and the copy offset is incorrect.

    This mirrors a bug pattern that was previously fixed in RRChangeOutputProperty but was not applied to the
    provider property path.

    An authenticated X client can trigger this by sending RandR ChangeProviderProperty requests with
    PrependMode on a system with RandR providers (standard on modern GPUs).The heap buffer overflow can lead
    to arbitrary code execution or denial of service.Fixed in: xorg-server-21.1.25 and xwayland-24.1.14Fix:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199 (CVE-2026-93521)

    The XI2 passive ungrab path (XIPassiveUngrabDevice) is missing the modifier validation that exists in the
    grab path and in legacy XI paths. Without checking against AllModifiersMask, a client can supply out-of-
    range modifier values that lead to an out-of-bounds write when the modifier is used as an index.

    An authenticated X client can trigger this by sending an XIPassiveUngrabDevice request with an out-of-
    range modifier value.The out-of-bounds write can lead to arbitrary code execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b (xorg-
    server-21.1.25) (CVE-2026-93523)

    CheckKeySyms() in xkb/xkb.c populates a symsPerKey[] validation array with new key widths for keys in the
    SetMap request range, then continues filling entries for keys beyond the range. However, the second loop
    starts at index i = nKeySyms (the first loop's counter) rather than i = firstKeySym + nKeySyms. When
    firstKeySym is large and nKeySyms is small, the second loop overwrites symsPerKey[target] with the old
    width from the existing map.

    CheckKeyActions() then validates the wire action count against the stale old width and accepts it. In
    _XkbSetMap(), SetKeySyms() widens the key (resizing actions to nGroups * newWidth), but SetKeyActions()
    then resizes again to the old count. A subsequent XkbGetMap request reads XkbKeyNumActions() entries
    (derived from the new wider key_sym_map.width) from the shorter action allocation, causing an out-of-
    bounds heap read. The overread bytes are copied into the GetMap reply and sent back to the requesting
    client, producing a bounded heap information disclosure.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/927ee1282d21550807619521bee909ef62ed0571 (xorg-
    server-21.1.25) (CVE-2026-93524)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2/ALAS2-2026-4014.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-88812.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93515.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93516.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93517.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93518.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93519.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93521.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93523.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93524.html");
  script_set_attribute(attribute:"solution", value:
"Run 'yum update xorg-x11-server' or
  or 'yum update --advisory ALAS2-2026-4014' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-93523");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xdmx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xephyr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xnest");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xorg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xvfb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xwayland");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-source");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'xorg-x11-server-common-1.20.4-22.amzn2.0.14', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-common-1.20.4-22.amzn2.0.14', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-common-1.20.4-22.amzn2.0.14', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-debuginfo-1.20.4-22.amzn2.0.14', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-debuginfo-1.20.4-22.amzn2.0.14', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-debuginfo-1.20.4-22.amzn2.0.14', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-devel-1.20.4-22.amzn2.0.14', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-devel-1.20.4-22.amzn2.0.14', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-devel-1.20.4-22.amzn2.0.14', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-source-1.20.4-22.amzn2.0.14', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xdmx-1.20.4-22.amzn2.0.14', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xdmx-1.20.4-22.amzn2.0.14', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xdmx-1.20.4-22.amzn2.0.14', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xephyr-1.20.4-22.amzn2.0.14', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xephyr-1.20.4-22.amzn2.0.14', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xephyr-1.20.4-22.amzn2.0.14', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xnest-1.20.4-22.amzn2.0.14', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xnest-1.20.4-22.amzn2.0.14', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xnest-1.20.4-22.amzn2.0.14', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xorg-1.20.4-22.amzn2.0.14', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xorg-1.20.4-22.amzn2.0.14', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xorg-1.20.4-22.amzn2.0.14', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xvfb-1.20.4-22.amzn2.0.14', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xvfb-1.20.4-22.amzn2.0.14', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xvfb-1.20.4-22.amzn2.0.14', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xwayland-1.20.4-22.amzn2.0.14', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xwayland-1.20.4-22.amzn2.0.14', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'xorg-x11-server-Xwayland-1.20.4-22.amzn2.0.14', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xorg-x11-server-Xdmx / xorg-x11-server-Xephyr / xorg-x11-server-Xnest / etc");
}