Xorg-x11-server: heap buffer overread/data leakage in procappledricreatepixmap

Summary

CVE	CVE-2024-31082
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2024-04-04 14:15:10 UTC
Updated	2026-11-04 22:17:20 UTC
Description	A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.

Primary CVSS: v3.1 7.3 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

EPSS: 0.003380000 probability, percentile 0.273900000 (date 2026-11-04)

Problem Types: CWE-126 | CWE-126 Buffer Over-read

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	7.3	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H`
3.1	CNA	CVSS	7.3	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Source	Vendor	Product	Version	Platforms
CNA	Red Hat	Red Hat Enterprise Linux 10	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 10	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 10	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 6	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 6	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified

Reference	Source	Link	Tags
access.redhat.com/security/cve/CVE-2024-31082	af854a3a-2127-422b-91ae-364da2661108	access.redhat.com
www.openwall.com/lists/oss-security/2024/04/12/10	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
www.openwall.com/lists/oss-security/2024/04/03/13	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
lists.x.org/archives/xorg-announce/2024-April/003497.html	af854a3a-2127-422b-91ae-364da2661108	lists.x.org
bugzilla.redhat.com/show_bug.cgi	af854a3a-2127-422b-91ae-364da2661108	bugzilla.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Source	Time	Event
CNA	2024-03-28T00:00:00.000Z	Reported to Red Hat.
CNA	2024-04-03T00:00:00.000Z	Made public.

200239 Ubuntu Security Notification for X.Org X Server Vulnerabilities (USN-6721-1)
510792 Alpine Linux Security Update for xorg-server
756106 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:1199-1)
756129 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:1262-1)
756130 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:1261-1)
756131 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2024:1260-1)