CVE-2020-29074: 
NixOS vulnerability analysis and mitigation

CVE-2020-29074 affects x11vnc version 0.9.16, a VNC server that allows remote access to existing X sessions. The vulnerability was discovered and disclosed in November 2020. The issue specifically affects the scan.c component of x11vnc, which creates shared memory segments with insecure permissions (NVD, Debian Security).

The vulnerability exists in the scan.c file where the shmget function is called with IPC_CREAT|0777 permissions, allowing unrestricted access to shared memory segments. This implementation flaw means that the shared memory segments created by the x11vnc server were readable and writable by any local user on the system, instead of being restricted to the user who executed the x11vnc server (GitHub Commit). The vulnerability has a CVSS v3.1 Base Score of 8.8 (High), indicating significant security impact (Ubuntu Security).

The vulnerability allows local attackers to potentially access, modify, or interfere with VNC sessions of other users on the host system. This can lead to information disclosure, denial of service, or unauthorized manipulation of other users' VNC sessions (Debian Security).

The vulnerability is exploitable by local users on systems running x11vnc version 0.9.16. No remote exploitation is required, as the attacker needs local access to the system to exploit the shared memory segment permissions (NVD).

The issue has been fixed by changing the shared memory segment permissions from 0777 to 0600, restricting access to only the user who executed the x11vnc server. Various distributions have released security updates: Debian released version 0.9.13-6+deb10u1 for the stable distribution (buster), Fedora released version 0.9.16-5.fc33, and other distributions have provided similar updates (Debian Security, Fedora Update).