Xorg-x11-server: selinux unlabeled glx pbuffer
Summary
| CVE | CVE-2024-0408 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-18 16:15:08 UTC |
| Updated | 2026-11-04 21:17:29 UTC |
| Description | A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL. |
Risk And Classification
Primary CVSS: v3.1 5.5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.003210000 probability, percentile 0.252770000 (date 2026-11-04)
Problem Types: CWE-158 | NVD-CWE-Other | CWE-158 Improper Neutralization of Null Byte or NUL Character
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | [email protected] | Secondary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 39 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Desktop | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux For Ibm Z Systems | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux For Power Big Endian | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux For Power Little Endian | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux For Scientific Computing | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 7.0 | All | All | All |
| Application | Tigervnc | Tigervnc | All | All | All | All |
| Application | X.org | Xwayland | All | All | All | All |
| Application | X.org | X Server | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 7 | unaffected 0:1.20.4-27.el7_9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:1.20.11-22.el8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:21.1.3-15.el8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:1.20.11-24.el9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:22.1.9-5.el9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| X.Org X Server, XWayland: Multiple Vulnerabilities (GLSA 202401-30) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| [SECURITY] [DLA 3721-1] xorg-server security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| 2257689 – (CVE-2024-0408) CVE-2024-0408 xorg-x11-server: SELinux unlabeled GLX PBuffer | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking |
| access.redhat.com/errata/RHSA-2024:2995 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| lists.fedoraproject.org/archives/list/[email protected]/messag... | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| access.redhat.com/errata/RHSA-2024:2169 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| [SECURITY] Fedora 39 Update: xorg-x11-server-Xwayland-23.2.4-1.fc39 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| access.redhat.com/errata/RHSA-2024:2996 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:2170 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| cve-details | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| [SECURITY] Fedora 39 Update: tigervnc-1.13.1-11.fc39 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| security.netapp.com/advisory/ntap-20240307-0006 | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank Donn Seeley and Olivier Fourdan for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-01-10T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2024-01-16T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Legacy QID Mappings
- 161304 Oracle Enterprise Linux Security Update for xorg-x11-server (ELSA-2024-0320)
- 200051 Ubuntu Security Notification for X.Org X Server Vulnerabilities (USN-6587-1)
- 200058 Ubuntu Security Notification for X.Org X Server Vulnerabilities (USN-6587-2)
- 200193 Ubuntu Security Notification for X.Org X Server Vulnerabilities (USN-6587-5)
- 242726 Red Hat Update for xorg-x11-server (RHSA-2024:0320)
- 257302 CentOS Security Update for xorg-x11-server (CESA-2024:0320)
- 284893 Fedora Security Update for xorg (FEDORA-2024-05db4bcbec)
- 285034 Fedora Security Update for tigervnc (FEDORA-2024-5762d637dd)
- 285036 Fedora Security Update for xorg (FEDORA-2024-da3d410b53)
- 357225 Amazon Linux Security Advisory for xorg-x11-server : ALAS2-2024-2455
- 357249 Amazon Linux Security Advisory for xorg-x11-server : ALAS2023-2024-522
- 510677 Alpine Linux Security Update for xorg-server
- 510678 Alpine Linux Security Update for xwayland
- 6000440 Debian Security Update for xorg-server (DSA 5603-1)
- 6000449 Debian Security Update for xorg-server (DLA 3721-1)
- 673399 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1352)
- 673626 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1232)
- 673929 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1254)
- 673935 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1330)
- 674121 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1522)
- 674159 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1501)
- 710847 Gentoo Linux X.Org X Server, XWayland Multiple Vulnerabilities (GLSA 202401-30)
- 755633 SUSE Enterprise Linux Security Update for xwayland (SUSE-SU-2024:0165-1)
- 755643 SUSE Enterprise Linux Security Update for xwayland (SUSE-SU-2024:0212-1)
- 755656 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:0236-1)
- 755661 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:0252-1)
- 755662 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:0251-1)
- 755664 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:0249-1)