CVE-2023-6478: 
NixOS vulnerability analysis and mitigation

CVE-2023-6478 was discovered in xorg-server, affecting versions prior to 21.1.10 and xwayland prior to 23.2.3. The vulnerability was introduced in xorg-server-1.4.0 (2007) and xorg-server-1.13.0 (2012) respectively, and was discovered by Jan-Niklas Sohn working with Trend Micro Zero Day Initiative (X.Org Announce).

The vulnerability involves an integer overflow in RRChangeProviderProperty and RRChangeOutputProperty requests. Length calculation for the request was clipped to a 32-bit integer. With the correct stuff->nUnits value, the expected request size was truncated, passing the REQUEST_FIXED_SIZE check. The server then proceeded with reading at least stuff->nUnits bytes from the request and storing it in the property, while also allocating at least stuff->nUnits bytes (i.e., 4GB) (X.Org Announce).

When successfully exploited, this vulnerability could lead to disclosure of sensitive information through out-of-bounds memory read (Red Hat CVE).

The vulnerability has been patched in xorg-server version 21.1.10 and xwayland version 23.2.3. The fix involves correcting the integer overflow in the length calculation for RRChangeProviderProperty and RRChangeOutputProperty requests (X.Org Announce).