CVE-2023-45919: 
NixOS vulnerability analysis and mitigation

Mesa 23.0.4 contains a buffer over-read vulnerability in the glXQueryServerString() function (CVE-2023-45919). The vulnerability was discovered and disclosed in January 2024, affecting the Mesa graphics library. This is a disputed vulnerability as there are no common situations in which users require uninterrupted operation with an attacker-controlled server (NVD).

The vulnerability stems from the glXQueryServerString() function trusting the on-the-wire string length returned in the xcb_glx_query_server_string_reply_t message without proper validation. The function uses an unchecked length value from the reply to allocate memory and perform a memcpy operation, which can lead to a buffer over-read condition. The CVSS v3.1 base score is 5.3 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. The vulnerability is classified as CWE-126 (Buffer Over-read) (NVD, Mesa Issue).

The buffer over-read vulnerability could potentially lead to information disclosure or system crashes. However, the practical impact is limited since it requires an attacker-controlled server, which is not a common operational scenario (NVD).

The vulnerability requires local access and user interaction to exploit. The attack complexity is low, but no privilege escalation is required. There are no reports of this vulnerability being exploited in the wild (Full Disclosure).