TencentOS Server 3: xorg-x11-server-Xwayland (TSSA-2023:0077)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2023:0077.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(239428);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/20");

  script_cve_id(
    "CVE-2022-3550",
    "CVE-2022-3551",
    "CVE-2022-4283",
    "CVE-2022-46340",
    "CVE-2022-46341",
    "CVE-2022-46342",
    "CVE-2022-46343",
    "CVE-2022-46344",
    "CVE-2023-0494"
  );

  script_name(english:"TencentOS Server 3: xorg-x11-server-Xwayland (TSSA-2023:0077)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0077 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-0494:
      A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in
    DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read
    and write into freed memory. This can lead to local privilege elevation on systems where the X server runs
    privileged and remote code execution for ssh X forwarding sessions.
      CVE-2022-46340:
      A vulnerability was found in X.Org. The issue occurs due to the swap handler for the XTestFakeInput
    request of the XTest extension, possibly corrupting the stack if GenericEvents with lengths larger than 32
    bytes are sent through the XTestFakeInput request. This flaw can lead to local privilege elevation on
    systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. This
    issue does not affect systems where the client and server use the same byte order.
      CVE-2022-4283:
      A vulnerability was found in X.Org. This issue occurs because the XkbCopyNames function leaves a
    dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName
    requests. This flaw can lead to local privilege elevation on systems where the X server runs privileged
    and remote code execution for ssh X forwarding sessions.
      CVE-2022-46340:
      A vulnerability was found in X.Org. The issue occurs due to the swap handler for the XTestFakeInput
    request of the XTest extension, possibly corrupting the stack if GenericEvents with lengths larger than 32
    bytes are sent through the XTestFakeInput request. This flaw can lead to local privilege elevation on
    systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. This
    issue does not affect systems where the client and server use the same byte order.
      CVE-2022-46341:
      A vulnerability was found in X.Org. This issue occurs because the handler for the XIPassiveUngrab
    request accesses out-of-bounds memory when invoked with a high keycode or button code. This flaw can lead
    to local privilege elevation on systems where the X server runs privileged and remote code execution for
    ssh X forwarding sessions.
      CVE-2022-46342:
      A vulnerability was found in X.Org. This flaw occurs because the handler for the XvdiSelectVideoNotify
    request may write to memory after it has been freed. This flaw can lead to local privilege elevation on
    systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.
      CVE-2022-46343:
      A vulnerability was found in X.Org. This issue occurs because the handler for the
    ScreenSaverSetAttributes request may write to memory after it has been freed. This flaw can lead to local
    privileges elevation on systems where the X server runs privileged and remote code execution for ssh X
    forwarding sessions.
      CVE-2022-46344:
      A vulnerability was found in X.Org. The issue occurs because the handler for the XIChangeProperty
    request has a length-validation issue, resulting in out-of-bounds memory reads and potential information
    disclosure. This flaw can lead to local privilege elevation on systems where the X server runs privileged
    and remote code execution for ssh X forwarding sessions.
      CVE-2022-3550:
      A flaw was found in the xorg-x11-server package. A buffer overflow can occur in the _GetCountedString
    function in xkb/xkb.c due to improper input validation, allowing for possible escalation of privileges,
    execution of arbitrary code, or a denial of service.
      CVE-2022-3551:
      A flaw was found in the xorg-x11-server package. The ProcXkbGetKbdByName function in xkb/xkb.c does not
    release allocated data when an error is encountered, allowing for a memory leak.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20230077.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-46344");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/06/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/06/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:xorg-x11-server-Xwayland");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'xorg-x11-server-Xwayland-21.1.3-10.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xorg-x11-server-Xwayland-21.1.3-10.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xorg-x11-server-Xwayland-debuginfo-21.1.3-10.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xorg-x11-server-Xwayland-debuginfo-21.1.3-10.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xorg-x11-server-Xwayland-debugsource-21.1.3-10.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xorg-x11-server-Xwayland-debugsource-21.1.3-10.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xorg-x11-server-Xwayland-devel-21.1.3-10.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xorg-x11-server-Xwayland-devel-21.1.3-10.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-debuginfo / xorg-x11-server-Xwayland-debugsource / etc');
}