CVE-2023-5380

What it actually does

Use-after-free in the X server when a pointer warp occurs between windows on separate protocol screens in Zaphod mode, followed by sequential window destruction, resulting in a crash.

Why it matters to the business

In rare legacy multi-monitor X11 configurations, an authenticated local user can trigger an X server crash that disrupts graphical sessions and requires restart, with negligible risk outside those exact conditions.

How an attack unfolds

An attacker with local access on a system using the legacy Zaphod multi-screen X configuration warps the pointer from a window on one screen to the root window of another screen, then destroys the original window followed by a second window, triggering the use-after-free and crashing the X server.

How to fix it

Upgrade xorg-x11-server to the commit 6197bea02eec072c19aa5365962e89949e674099 or later; organizations still using Zaphod mode should migrate to modern RandR-based multi-monitor setups.

How to confirm the fix worked

Confirm the installed xserver package reports a version containing commit 6197bea02eec072c19aa5365962e89949e674099; test the affected pointer-warp and window-destruction sequence in a lab Zaphod configuration to verify the server no longer crashes.

Typical attack path

1. Obtain local shell access on a target system running Xorg in Zaphod multi-screen mode
2. Position windows across the separate protocol screens
3. Warp the pointer from a window on one screen to the root window of the second screen
4. Destroy the original window then a subsequent window to trigger the use-after-free
5. Observe X server crash and resulting denial of service

How to detect it

Review Xorg logs and system crash reports for repeated server restarts coinciding with pointer-warp events in multi-screen environments; correlate with local user sessions that have access to multiple protocol screens.

What your security team should do

• Inventory all systems running Xorg and identify any still configured for Zaphod multi-screen mode
• Apply the fixed commit or newer package version on affected hosts
• Plan migration away from legacy Zaphod configurations to standard RandR multi-monitor support
• Monitor X server crash logs for the specific warp-and-destroy pattern until patches are deployed