Vulnerability Description
A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tigervnc | Tigervnc | < 1.13.1 |
| X.Org | X Server | < 21.1.11 |
| X.Org | Xwayland | < 23.2.4 |
| Fedoraproject | Fedora | 39 |
| Redhat | Enterprise Linux | 6.0 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux For Ibm Z Systems | 7.0 |
| Redhat | Enterprise Linux For Power Big Endian | 7.0 |
| Redhat | Enterprise Linux For Power Little Endian | 7.0 |
| Redhat | Enterprise Linux For Scientific Computing | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Workstation | 7.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2024:0320Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:2169
- https://access.redhat.com/errata/RHSA-2024:2170
- https://access.redhat.com/errata/RHSA-2024:2995
- https://access.redhat.com/errata/RHSA-2024:2996
- https://access.redhat.com/security/cve/CVE-2024-0408Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2257689Issue Tracking
- https://access.redhat.com/errata/RHSA-2024:0320Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:2169
- https://access.redhat.com/errata/RHSA-2024:2170
- https://access.redhat.com/errata/RHSA-2024:2995
- https://access.redhat.com/errata/RHSA-2024:2996
- https://access.redhat.com/security/cve/CVE-2024-0408Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2257689Issue Tracking
- https://lists.debian.org/debian-lts-announce/2024/01/msg00016.html
FAQ
What is CVE-2024-0408?
CVE-2024-0408 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (a...
How severe is CVE-2024-0408?
CVE-2024-0408 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-0408?
Check the references section above for vendor advisories and patch information. Affected products include: Tigervnc Tigervnc, X.Org X Server, X.Org Xwayland, Fedoraproject Fedora, Redhat Enterprise Linux.