Xorg-x11-server: selinux context corruption
Summary
| CVE | CVE-2024-0409 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-18 16:15:08 UTC |
| Updated | 2026-11-04 21:17:30 UTC |
| Description | A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.003560000 probability, percentile 0.294650000 (date 2026-11-04)
Problem Types: CWE-787 | CWE-787 Out-of-bounds Write
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | [email protected] | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 39 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Desktop | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux For Ibm Z Systems | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux For Power Big Endian | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux For Power Little Endian | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux For Scientific Computing | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 7.0 | All | All | All |
| Application | Tigervnc | Tigervnc | All | All | All | All |
| Application | X.org | Xwayland | All | All | All | All |
| Application | X.org | X Server | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 7 | unaffected 0:1.20.4-27.el7_9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:1.20.11-22.el8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:21.1.3-15.el8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:1.20.11-24.el9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:22.1.9-5.el9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| X.Org X Server, XWayland: Multiple Vulnerabilities (GLSA 202401-30) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| [SECURITY] [DLA 3721-1] xorg-server security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| access.redhat.com/errata/RHSA-2024:2995 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| lists.fedoraproject.org/archives/list/[email protected]/messag... | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| cve-details | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| 2257690 – (CVE-2024-0409) CVE-2024-0409 xorg-x11-server: SELinux context corruption | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Third Party Advisory |
| access.redhat.com/errata/RHSA-2024:2169 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| [SECURITY] Fedora 39 Update: xorg-x11-server-Xwayland-23.2.4-1.fc39 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| access.redhat.com/errata/RHSA-2024:2996 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:2170 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| [SECURITY] Fedora 39 Update: tigervnc-1.13.1-11.fc39 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| security.netapp.com/advisory/ntap-20240307-0006 | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank Olivier Fourdan for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-01-10T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2024-01-16T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Legacy QID Mappings
- 161304 Oracle Enterprise Linux Security Update for xorg-x11-server (ELSA-2024-0320)
- 200051 Ubuntu Security Notification for X.Org X Server Vulnerabilities (USN-6587-1)
- 200058 Ubuntu Security Notification for X.Org X Server Vulnerabilities (USN-6587-2)
- 242726 Red Hat Update for xorg-x11-server (RHSA-2024:0320)
- 257302 CentOS Security Update for xorg-x11-server (CESA-2024:0320)
- 284893 Fedora Security Update for xorg (FEDORA-2024-05db4bcbec)
- 285034 Fedora Security Update for tigervnc (FEDORA-2024-5762d637dd)
- 285036 Fedora Security Update for xorg (FEDORA-2024-da3d410b53)
- 357225 Amazon Linux Security Advisory for xorg-x11-server : ALAS2-2024-2455
- 357249 Amazon Linux Security Advisory for xorg-x11-server : ALAS2023-2024-522
- 510677 Alpine Linux Security Update for xorg-server
- 510678 Alpine Linux Security Update for xwayland
- 6000440 Debian Security Update for xorg-server (DSA 5603-1)
- 6000449 Debian Security Update for xorg-server (DLA 3721-1)
- 673399 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1352)
- 673626 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1232)
- 673929 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1254)
- 673935 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1330)
- 674121 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1522)
- 674159 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1501)
- 710847 Gentoo Linux X.Org X Server, XWayland Multiple Vulnerabilities (GLSA 202401-30)
- 755633 SUSE Enterprise Linux Security Update for xwayland (SUSE-SU-2024:0165-1)
- 755643 SUSE Enterprise Linux Security Update for xwayland (SUSE-SU-2024:0212-1)
- 755656 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:0236-1)
- 755661 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:0252-1)
- 755662 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:0251-1)
- 755664 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:0249-1)