CVE-2024-31080

What it actually does

Heap-based buffer over-read in ProcXIGetSelectedEvents allowing the X server to read beyond allocated memory when processing byte-swapped length values from different-endianness clients, resulting in memory disclosure in replies followed by a crash on unmapped pages.

Why it matters to the business

Local users or processes can crash graphical sessions on X11 systems and potentially leak portions of heap memory, leading to service disruption and confidentiality exposure in environments relying on the X server for desktop or application display.

How an attack unfolds

An attacker establishes a local X11 connection using a client with opposite endianness, issues a crafted XIGetSelectedEvents request containing manipulated length values, causes the server to perform an out-of-bounds heap read, and receives the leaked memory contents in replies until the server encounters an unmapped page and crashes.

How to fix it

Update the X.org server package to a patched release that correctly validates byte-swapped lengths before processing replies in the XI extension; apply distribution-specific security updates as they become available.

How to confirm the fix worked

Confirm the installed X.org server version includes fixes for length validation in ProcXIGetSelectedEvents, review changelog entries for buffer handling corrections, and test with endianness-swapped client connections to ensure no crashes occur.

Typical attack path

1. Establish local X11 connection with mismatched client endianness
2. Send crafted ProcXIGetSelectedEvents request with swapped length fields
3. Trigger repeated out-of-bounds heap memory reads
4. Receive disclosed memory in server replies until crash

How to detect it

Review X server logs and syslog for segmentation fault entries mentioning XIGetSelectedEvents or the input extension; inspect for repeated client connection attempts followed by abrupt server restarts.

What your security team should do

• Apply available X.org server updates immediately on all affected systems
• Monitor system logs for X server segmentation faults related to the XI extension
• Limit local user access to X11 sockets where feasible until patched