CVE-2023-3138 Memory corruption in libX11
A malicious X server or proxy can cause client crashes via out-of-bounds writes in libX11 due to missing bounds checks on protocol IDs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3138?
CVE-2023-3138 is a high-severity memory corruption vulnerability in Redhat Enterprise Linux, published on 28 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.
Which versions are affected by CVE-2023-3138?
It affects 2 products.
Linux distribution packages (40)
libX11 AlmaLinux:8 | All versions | 1.6.8-6.el8 |
libX11-common AlmaLinux:8 | All versions | 1.6.8-6.el8 |
libX11-devel AlmaLinux:8 | All versions | 1.6.8-6.el8 |
libX11-xcb AlmaLinux:8 | All versions | 1.6.8-6.el8 |
libX11 AlmaLinux:9 | All versions | 1.7.0-8.el9 |
libX11-common AlmaLinux:9 | All versions | 1.7.0-8.el9 |
libX11-devel AlmaLinux:9 | All versions | 1.7.0-8.el9 |
libX11-xcb AlmaLinux:9 | All versions | 1.7.0-8.el9 |
libX11 Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-6.el8 |
libX11-common Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-6.el8 |
libX11-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-6.el8 |
libX11-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-6.el8 |
libX11-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-6.el8 |
libX11-xcb Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-6.el8 |
libX11-xcb-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.6.8-6.el8 |
libX11 Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-8.el9 |
libX11-common Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-8.el9 |
libX11-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-8.el9 |
libX11-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-8.el9 |
libX11-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-8.el9 |
libX11-xcb Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-8.el9 |
libX11-xcb-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-8.el9 |
libX11 Red Hat:rhel_eus:8.8::appstream | All versions | 0:1.6.8-6.el8_8 |
libX11-common Red Hat:rhel_eus:8.8::appstream | All versions | 0:1.6.8-6.el8_8 |
libX11-debuginfo Red Hat:rhel_eus:8.8::appstream | All versions | 0:1.6.8-6.el8_8 |
libX11-debugsource Red Hat:rhel_eus:8.8::appstream | All versions | 0:1.6.8-6.el8_8 |
libX11-devel Red Hat:rhel_eus:8.8::appstream | All versions | 0:1.6.8-6.el8_8 |
libX11-xcb Red Hat:rhel_eus:8.8::appstream | All versions | 0:1.6.8-6.el8_8 |
libX11-xcb-debuginfo Red Hat:rhel_eus:8.8::appstream | All versions | 0:1.6.8-6.el8_8 |
libX11 Red Hat:rhel_eus:9.2::appstream | All versions | 0:1.7.0-8.el9_2 |
libX11-common Red Hat:rhel_eus:9.2::appstream | All versions | 0:1.7.0-8.el9_2 |
libX11-debuginfo Red Hat:rhel_eus:9.2::appstream | All versions | 0:1.7.0-8.el9_2 |
libX11-debugsource Red Hat:rhel_eus:9.2::appstream | All versions | 0:1.7.0-8.el9_2 |
libX11-devel Red Hat:rhel_eus:9.2::appstream | All versions | 0:1.7.0-8.el9_2 |
libX11-xcb Red Hat:rhel_eus:9.2::appstream | All versions | 0:1.7.0-8.el9_2 |
libX11-xcb-debuginfo Red Hat:rhel_eus:9.2::appstream | All versions | 0:1.7.0-8.el9_2 |
libX11 SUSE:Enterprise Storage 7 | All versions | 1.6.5-150000.3.30.1 |
libX11 SUSE:Enterprise Storage 7.1 | All versions | 1.6.5-150000.3.30.1 |
libX11 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.6.5-150000.3.30.1 |
libX11 SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 1.6.5-150000.3.30.1 |
Products include Redhat Enterprise Linux, X.org Libx11.
How do I fix CVE-2023-3138?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-3138 being exploited?
There is no known exploitation of CVE-2023-3138 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection
- CVE-2021-20325 Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit
- CVE-2018-25011 Memory corruption in libwebp
- CVE-2018-25014 Other in libwebp
- CVE-2014-3585 Supply chain in redhat-upgrade-tool
Sources
Also known as ALPINE-CVE-2023-3138, ALSA-2023:6497, ALSA-2023:7029, AZL-27274, CLSA-2025-1745270046, DEBIAN-CVE-2023-3138 and 19 more.