CVE-2024-31081

What it actually does

Heap-based buffer over-read in X.org ProcXIPassiveGrabDevice() triggered by byte-swapped length values in replies from clients of differing endianness, resulting in uncontrolled heap memory reads until an unmapped page and potential segmentation fault.

Why it matters to the business

Local users on affected Ubuntu systems can trigger X server crashes that disrupt graphical sessions and applications, with the vulnerability remaining exploitable years after disclosure on widely deployed LTS kernels.

How an attack unfolds

A local attacker launches an X client compiled or configured for opposite endianness, sends a crafted ProcXIPassiveGrabDevice request containing swapped length fields, and forces the server to perform large out-of-bounds heap reads that either leak memory contents back to the client or crash the X server.

How to fix it

Upgrade the linux, linux-aws, linux-azure, linux-kvm and related packages to the exact fixed versions supplied for each Ubuntu release (e.g., linux 4.15.0-1001.1 on 18.04, linux 5.4.0-9.12 on 20.04, linux-aws-5.15 5.15.0-1014.18~20.04.1, etc.) and reboot.

How to confirm the fix worked

Verify the running kernel matches one of the listed fixed package versions, confirm X server starts without immediate crash under mixed-endian client testing, and re-check package manager output for pending updates.

Typical attack path

1. Obtain local shell access on an affected Ubuntu system running a vulnerable X server
2. Execute or compile an X client with mismatched byte order
3. Issue a ProcXIPassiveGrabDevice request containing swapped length values
4. Observe server reply containing heap memory or trigger segmentation fault

How to detect it

Review system and Xorg logs for segmentation faults or abrupt X server terminations coinciding with local X client activity; inspect for repeated passive-grab related errors or heap-related crash signatures.

What your security team should do

• Apply the listed kernel updates on all affected Ubuntu 18.04 and 20.04 systems immediately
• Prioritize systems that expose X11 to untrusted local users or multi-architecture environments
• Remove or isolate legacy X11 workloads where feasible
• Monitor for new kernel updates in the same series