NetSight
IP …
medium5.5

CVE-2024-0408

A flaw was found in the X.Org server.

Impact

A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.

Affected products

VendorProductAffected versions
TigervncTigervnc
before 1.13.1
X.OrgX Server
before 21.1.11
X.OrgXwayland
before 23.2.4
FedoraprojectFedora
Version 39
RedhatEnterprise Linux
Versions 6.0, 7.0, 8.0, 9.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux For Ibm Z Systems
Version 7.0
RedhatEnterprise Linux For Power Big Endian
Version 7.0
RedhatEnterprise Linux For Power Little Endian
Version 7.0
RedhatEnterprise Linux For Scientific Computing
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Workstation
Version 7.0

Weakness classification

CWE-158

References