ALAS2023-2026-1789

Font Alias Stack-based Buffer Overflow: A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks.

XSYNC Use-After-Free in miSyncDestroyFence(): A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free.

XKB Key Types Stack-based Buffer Overflow: The X server has multiple stack buffers that are sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger three separate stack overflows.

XKB SetMap Request Stack-based Buffer Overflow: _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow.

XSYNC Use-After-Free in FreeCounter(): A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection.

XSYNC Use-After-Free in SyncChangeCounter(): A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters.

GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write: A wrong size validation check in __glXDisp_ChangeDrawableAttributes() can read (or write) a client-controlled number of bytes, exceeding the request buffer. The write path requires byte-swapped clients which is disabled by default. The read can lead to information disclosure, the write can be used to crash the server, or for privilege escalation if the X server runs as root.

CreateSaverWindow Use-After-Free Information Disclosure: A client can trigger a use-after-free read after changing window attributes and forcing the screen saver. This can lead to information disclosure.

aarch64:
    xorg-x11-server-Xwayland-debuginfo-24.1.3-1.amzn2023.0.5.aarch64
    xorg-x11-server-Xwayland-devel-24.1.3-1.amzn2023.0.5.aarch64
    xorg-x11-server-Xwayland-24.1.3-1.amzn2023.0.5.aarch64
    xorg-x11-server-Xwayland-debugsource-24.1.3-1.amzn2023.0.5.aarch64

src:
    xorg-x11-server-Xwayland-24.1.3-1.amzn2023.0.5.src

x86_64:
    xorg-x11-server-Xwayland-debuginfo-24.1.3-1.amzn2023.0.5.x86_64
    xorg-x11-server-Xwayland-devel-24.1.3-1.amzn2023.0.5.x86_64
    xorg-x11-server-Xwayland-24.1.3-1.amzn2023.0.5.x86_64
    xorg-x11-server-Xwayland-debugsource-24.1.3-1.amzn2023.0.5.x86_64