CVE-2024-31082

What it actually does

Heap-based buffer over-read in X.org server's ProcAppleDRICreatePixmap() triggered by byte-swapped length values, enabling unauthorized reads of heap memory that are transmitted back to the client until an unmapped page causes a crash.

Why it matters to the business

Local attackers can crash the X server and leak limited heap contents on affected systems, leading to denial of service and potential exposure of sensitive in-memory data in environments using the vulnerable package.

How an attack unfolds

An attacker with local access connects to the X server using a client of differing endianness and sends crafted requests to ProcAppleDRICreatePixmap containing manipulated byte-swapped lengths, causing the server to perform out-of-bounds heap reads and return the data until a segmentation fault occurs.

How to fix it

Upgrade the X.org server package to a fixed release; for the listed affected product, update cert-manager-fips-1.13 to version 1.13.5-r3 or later.

How to confirm the fix worked

Confirm the installed X server package version matches or exceeds the fixed release and verify absence of the vulnerable ProcAppleDRICreatePixmap implementation through code review or package manifests.

Typical attack path

1. Gain local user access on the target system
2. Connect to the running X server as a client
3. Issue ProcAppleDRICreatePixmap requests with swapped length values
4. Trigger repeated out-of-bounds reads that return heap data and eventually crash the server

How to detect it

Examine X server logs and system crash reports for segmentation faults originating from ProcAppleDRICreatePixmap, and correlate with client connections that exhibit endianness mismatches.

What your security team should do

• Apply the vendor-supplied update to all systems running the vulnerable X.org package
• Limit local access to X server instances where feasible
• Review and restrict clients that may present differing endianness