CVE-2023-0494 Use after free in xorg-x11-server
A use-after-free in X.Org allows local privilege escalation and remote code execution via SSH X forwarding.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-0494?
CVE-2023-0494 is a high-severity use after free vulnerability in Fedoraproject Fedora, published on 27 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.
Weakness: CWE-416
Which versions are affected by CVE-2023-0494?
It affects 18 products.
Linux distribution packages (40)
tigervnc AlmaLinux:8 | All versions | 1.12.0-9.el8_7.1 |
tigervnc-icons AlmaLinux:8 | All versions | 1.12.0-9.el8_7.1 |
tigervnc-license AlmaLinux:8 | All versions | 1.12.0-9.el8_7.1 |
tigervnc-selinux AlmaLinux:8 | All versions | 1.12.0-9.el8_7.1 |
tigervnc-server AlmaLinux:8 | All versions | 1.12.0-9.el8_7.1 |
tigervnc-server-minimal AlmaLinux:8 | All versions | 1.12.0-9.el8_7.1 |
tigervnc-server-module AlmaLinux:8 | All versions | 1.12.0-9.el8_7.1 |
tigervnc AlmaLinux:9 | All versions | 1.12.0-5.el9_1.1 |
tigervnc-icons AlmaLinux:9 | All versions | 1.12.0-5.el9_1.1 |
tigervnc-license AlmaLinux:9 | All versions | 1.12.0-5.el9_1.1 |
tigervnc-selinux AlmaLinux:9 | All versions | 1.12.0-5.el9_1.1 |
tigervnc-server AlmaLinux:9 | All versions | 1.12.0-5.el9_1.1 |
tigervnc-server-minimal AlmaLinux:9 | All versions | 1.12.0-5.el9_1.1 |
tigervnc-server-module AlmaLinux:9 | All versions | 1.12.0-5.el9_1.1 |
tigervnc Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-24.el7_9 |
tigervnc-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-24.el7_9 |
tigervnc-icons Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-24.el7_9 |
tigervnc-license Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-24.el7_9 |
tigervnc-server Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-24.el7_9 |
tigervnc-server-applet Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-24.el7_9 |
tigervnc-server-minimal Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-24.el7_9 |
tigervnc-server-module Red Hat:enterprise_linux:7::client | All versions | 0:1.8.0-24.el7_9 |
xorg-x11-server Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
xorg-x11-server-Xdmx Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
xorg-x11-server-Xephyr Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
xorg-x11-server-Xnest Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
xorg-x11-server-Xorg Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
xorg-x11-server-Xvfb Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
xorg-x11-server-Xwayland Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
xorg-x11-server-common Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
xorg-x11-server-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
xorg-x11-server-devel Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
xorg-x11-server-source Red Hat:enterprise_linux:7::client | All versions | 0:1.20.4-22.el7_9 |
tigervnc Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.0-24.el7_9 |
tigervnc-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.0-24.el7_9 |
tigervnc-icons Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.0-24.el7_9 |
tigervnc-server Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.0-24.el7_9 |
tigervnc-server-applet Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.0-24.el7_9 |
tigervnc-server-module Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.0-24.el7_9 |
xorg-x11-server Red Hat:enterprise_linux:7::computenode | All versions | 0:1.20.4-22.el7_9 |
Products include Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Enterprise Linux Aus, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux for Ibm Z Systems and 12 more.
How do I fix CVE-2023-0494?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-0494 being exploited?
There is no known exploitation of CVE-2023-0494 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALSA-2023:0622, ALSA-2023:0662, DEBIAN-CVE-2023-0494, DLA-3310-1, DSA-5342-1, GHSA-5v6x-2hpj-c37x and 23 more.