CVE-2024-0229: 
NixOS vulnerability analysis and mitigation

CVE-2024-0229 is an out-of-bounds memory access vulnerability discovered in the X.Org server. The vulnerability was identified in early 2024 and affects X.Org server versions up to 21.1.11 and XWayland versions up to 23.2.4. The issue occurs when a device frozen by a sync grab is reattached to a different master device (NVD).

The vulnerability stems from an incorrect calculation of button numbers that results in out-of-bounds memory access. When a device frozen by a sync grab is reattached to a different master device, the number of buttons is incorrectly calculated to be zero, leading to potential memory access violations. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Red Hat).

The vulnerability can lead to multiple severe consequences: application crashes, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments (NVD).

The vulnerability has been patched in X.Org server version 21.1.11 and XWayland version 23.2.4. Multiple vendors have released security updates to address this issue, including Red Hat Enterprise Linux through various security advisories (Ubuntu).