Lucene search

[email protected]NVD:CVE-2024-0408

HistoryJan 18, 2024 - 4:15 p.m.

CVE-2024-0408

2024-01-1816:15:08

CWE-158

[email protected]

web.nvd.nist.gov

x.org

xace hook

glx pbuffer

xselinux

sid

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

Percentile

5.1%

JSON

A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.

Affected configurations

Nvd

Node

tigervnctigervncRange<1.13.1

x.orgxorg-serverRange<21.1.11

x.orgxwaylandRange<23.2.4

Node

fedoraprojectfedoraMatch39

redhatenterprise_linuxMatch6.0

redhatenterprise_linuxMatch7.0

redhatenterprise_linuxMatch8.0

redhatenterprise_linuxMatch9.0

redhatenterprise_linux_desktopMatch7.0

redhatenterprise_linux_for_ibm_z_systemsMatch7.0

redhatenterprise_linux_for_power_big_endianMatch7.0

redhatenterprise_linux_for_power_little_endianMatch7.0

redhatenterprise_linux_for_scientific_computingMatch7.0

redhatenterprise_linux_serverMatch7.0

redhatenterprise_linux_workstationMatch7.0

VendorProductVersionCPE
tigervnctigervnc*cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*
x.orgxorg-server*cpe:2.3:a:x.org:xorg-server:*:*:*:*:*:*:*:*
x.orgxwayland*cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
fedoraprojectfedora39cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
redhatenterprise_linux6.0cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
redhatenterprise_linux7.0cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
redhatenterprise_linux8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhatenterprise_linux9.0cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
redhatenterprise_linux_desktop7.0cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
redhatenterprise_linux_for_ibm_z_systems7.0cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tigervnc	tigervnc	*	cpe:2.3:a:tigervnc:tigervnc::::::::
x.org	xorg-server	*	cpe:2.3:a:x.org:xorg-server::::::::
x.org	xwayland	*	cpe:2.3:a:x.org:xwayland::::::::
fedoraproject	fedora	39	cpe:2.3:o:fedoraproject:fedora:39:::::::*
redhat	enterprise_linux	6.0	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
redhat	enterprise_linux	7.0	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
redhat	enterprise_linux	9.0	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*
redhat	enterprise_linux_desktop	7.0	cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
redhat	enterprise_linux_for_ibm_z_systems	7.0	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:::::::*