CVE-2021-31535 Code injection in n/a
Remote attackers can execute arbitrary code or bypass authorization by sending oversized color lookup requests to the X server via the libX11 library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-31535?
CVE-2021-31535 is a critical code injection vulnerability in Fedoraproject Fedora, published on 27 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session.
Weakness: CWE-120
Which versions are affected by CVE-2021-31535?
It affects 3 products.
Linux distribution packages (40)
libX11 AlmaLinux:8 | All versions | 1.6.8-5.el8 |
libX11-common AlmaLinux:8 | All versions | 1.6.8-5.el8 |
libX11-devel AlmaLinux:8 | All versions | 1.6.8-5.el8 |
libX11-xcb AlmaLinux:8 | All versions | 1.6.8-5.el8 |
libX11 Red Hat:enterprise_linux:7::client | All versions | 0:1.6.7-4.el7_9 |
libX11-common Red Hat:enterprise_linux:7::client | All versions | 0:1.6.7-4.el7_9 |
libX11-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.6.7-4.el7_9 |
libX11-devel Red Hat:enterprise_linux:7::client | All versions | 0:1.6.7-4.el7_9 |
libX11-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:1.6.7-4.el7_9 |
libX11-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:1.6.7-4.el7_9 |
libX11 Red Hat:enterprise_linux:7::server | All versions | 0:1.6.7-4.el7_9 |
libX11-common Red Hat:enterprise_linux:7::server | All versions | 0:1.6.7-4.el7_9 |
libX11-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1.6.7-4.el7_9 |
libX11-devel Red Hat:enterprise_linux:7::server | All versions | 0:1.6.7-4.el7_9 |
libX11 Red Hat:enterprise_linux:7::workstation | All versions | 0:1.6.7-4.el7_9 |
libX11-common Red Hat:enterprise_linux:7::workstation | All versions | 0:1.6.7-4.el7_9 |
libX11-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:1.6.7-4.el7_9 |
libX11-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:1.6.7-4.el7_9 |
libX11 Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-5.el8 |
libX11-common Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-5.el8 |
libX11-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-5.el8 |
libX11-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-5.el8 |
libX11-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-5.el8 |
libX11-xcb Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-5.el8 |
libX11-xcb-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-5.el8 |
libX11 Rocky Linux:8 | All versions | 0:1.6.8-5.el8 |
libX11 SUSE:Enterprise Storage 6 | All versions | 1.6.5-3.21.1 |
libX11 SUSE:HPE Helion OpenStack 8 | All versions | 1.6.2-12.21.1 |
libX11 SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 1.6.5-3.21.1 |
libX11 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.6.5-3.21.1 |
libX11 SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 1.6.5-3.21.1 |
libX11 SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 1.6.5-3.21.1 |
libX11 SUSE:Linux Enterprise Micro 5.0 | All versions | 1.6.5-3.18.1 |
libX11 SUSE:Linux Enterprise Micro 5.0 | All versions | 1.6.5-3.21.1 |
libX11 SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 1.6.5-3.18.1 |
libX11 SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 1.6.5-3.21.1 |
libX11 SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 1.6.5-3.18.1 |
libX11 SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 1.6.5-3.21.1 |
xorg-x11-libX11 SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 7.4-5.11.72.27.1 |
xorg-x11-libX11 SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 7.4-5.11.72.27.1 |
Products include Fedoraproject Fedora, X.org Libx11, X.org X Window System.
How do I fix CVE-2021-31535?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-31535 being exploited?
There is no known exploitation of CVE-2021-31535 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2021-31535, ALSA-2021:4326, DEBIAN-CVE-2021-31535, DLA-2666-1, DSA-4920-1, GHSA-3vp2-rf63-rc8p and 17 more.