CVE-2017-10971
High · 8.8CVSS
8.8
EPSS
3.9%
Published
Jul 6, 2017
CISA due date
—
Cloudanix analysis
A problem in the software that runs the computer screen lets someone already logged into a graphical session crash the screen system or run their own programs inside it.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Remote Code Execution
- Component
- Application
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Stack-based buffer overflow in X.Org X server endianness conversion routine for X Events allows an authenticated X session user to corrupt memory and achieve code execution or denial of service in the X server process context.
Why it matters to the business
Attackers with an existing authenticated graphical session can crash the display server or run arbitrary code, leading to loss of user sessions, potential privilege escalation on multi-user systems, and disruption of graphical workloads.
How an attack unfolds
An attacker with an active X session crafts X protocol events containing manipulated byte-order indicators, sends them to the X server, and triggers the vulnerable endianness conversion path that overflows the stack and redirects execution.
How to fix it
Upgrade the X.Org X server to a version released on or after 2017-06-19 that contains the endianness conversion fix; rebuild any locally compiled X servers with the patch applied and restart the display manager after installation.
How to confirm the fix worked
Verify the installed X server binary or package reports a build date on or after 2017-06-19; run regression tests that exercise X event endianness conversion and confirm the server no longer crashes on malformed events.
Typical attack path
- Obtain an authenticated X session on the target host
- Generate or replay X Events with crafted endianness fields
- Deliver the events to the X server via the X protocol
- Trigger stack overflow during conversion to achieve code execution or crash
How to detect it
Review X server logs and system crash reports for repeated stack overflow signals or sudden X process terminations; correlate with authenticated user session activity around the time of the event.
What your security team should do
- Prioritize patching all X.Org X server instances to a post-2017-06-19 release
- Restrict direct X protocol access where possible using SSH X11 forwarding or network isolation
- Monitor X server process crashes and anomalous event volumes in system logs
- Review and reduce unnecessary local graphical session privileges
The record
In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | xorg-server | 0 | 2:1.19.3-2 |
| Debian:12 | xorg-server | 0 | 2:1.19.3-2 |
| Debian:13 | xorg-server | 0 | 2:1.19.3-2 |
| Debian:14 | xorg-server | 0 | 2:1.19.3-2 |
| Debian:7 | xorg-server | 0 | 2:1.12.4-6+deb7u7 |
| Debian:8 | xorg-server | 0 | 2:1.16.4-1+deb8u1 |
| Debian:9 | xorg-server | 0 | 2:1.19.2-1+deb9u1 |
| Mageia:5 | x11-server | 0 | 1.16.4-2.2.mga5 |
| SUSE:Linux Enterprise Desktop 12 SP2 | xorg-x11-server | 0 | 7.6_1.18.3-74.2 |
| SUSE:Linux Enterprise Point of Sale 11 SP3 | xorg-x11-server | 0 | 7.4-27.121.2 |
| SUSE:Linux Enterprise Server 11 SP3-LTSS | xorg-x11-server | 0 | 7.4-27.121.2 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | xorg-x11-server | 0 | 7.4-27.121.2 |
| SUSE:Linux Enterprise Server 11 SP4 | xorg-x11-server | 0 | 7.4-27.121.2 |
| SUSE:Linux Enterprise Server 12 SP1-LTSS | xorg-x11-server | 0 | 7.6_1.15.2-53.3.1 |
| SUSE:Linux Enterprise Server 12 SP2 | xorg-x11-server | 0 | 7.6_1.18.3-74.2 |
| SUSE:Linux Enterprise Server 12-LTSS | xorg-x11-server | 0 | 7.6_1.15.2-30.22.1 |
| SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | xorg-x11-server | 0 | 7.6_1.18.3-74.2 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | xorg-x11-server | 0 | 7.4-27.121.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | xorg-x11-server | 0 | 7.6_1.15.2-30.22.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | xorg-x11-server | 0 | 7.6_1.15.2-53.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | xorg-x11-server | 0 | 7.6_1.18.3-74.2 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | xorg-x11-server | 0 | 7.4-27.121.2 |
| SUSE:Linux Enterprise Software Development Kit 12 SP2 | xorg-x11-server | 0 | 7.6_1.18.3-74.2 |
| SUSE:OpenStack Cloud 6 | xorg-x11-server | 0 | 7.6_1.15.2-53.3.1 |
| Ubuntu:14.04:LTS | xorg-server | 0 | 2:1.15.1-0ubuntu2.9 |
| Ubuntu:14.04:LTS | xorg-server-lts-xenial | 0 | 2:1.18.3-1ubuntu2.3~trusty2 |
| Ubuntu:16.04:LTS | xorg-server | 0 | 2:1.18.4-0ubuntu0.3 |
| Ubuntu:16.04:LTS | xorg-server-hwe-16.04 | 0 | 2:1.18.4-1ubuntu6.1~16.04.2 |
| openSUSE:Tumbleweed | xorg-x11-server | 0 | 1.20.13-1.2 |
Related vulnerabilities
- CVE-2024-9632 A flaw was found in the X.org server. Also affects xorg-server
- CVE-2024-31083 A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg… Also affects xorg-server
- CVE-2024-31081 A heap-based buffer over-read vulnerability was found in the X.org server's… Also affects xorg-server
- CVE-2024-31082 A heap-based buffer over-read vulnerability was found in the X.org server's… Also affects xorg-server
- CVE-2024-31080 A heap-based buffer over-read vulnerability was found in the X.org server's… Also affects xorg-server
- CVE-2024-21886 A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. Also affects xorg-server
- CVE-2024-21885 A flaw was found in X.Org server. Also affects xorg-server
- CVE-2024-0229 An out-of-bounds memory access flaw was found in the X.Org server. Also affects xorg-server