CVE-2024-21885 Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent
A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments.
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION
cpes: cpe:/o:redhat:rhel_els:6
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7::workstation
cpe:/o:redhat:enterprise_linux:7::server
cpe:/o:redhat:enterprise_linux:7::computenode
cpe:/o:redhat:enterprise_linux:7::client
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7::workstation
cpe:/o:redhat:enterprise_linux:7::server
cpe:/o:redhat:enterprise_linux:7::computenode
cpe:/o:redhat:enterprise_linux:7::client
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Advanced Update Support
cpes: cpe:/a:redhat:rhel_e4s:8.2::appstream
cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_tus:8.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_e4s:8.2::appstream
cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_tus:8.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:8.2::appstream
cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_tus:8.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.0::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Jan-Niklas Sohn (Trend Micro Zero Day Initiative) for reporting this issue.
Published: 2024-02-28T12:11:59.650Z