CVE-2024-21885: 
TigerVNC vulnerability analysis and mitigation

A vulnerability (CVE-2024-21885) was discovered in the X.Org server, specifically in the XISendDeviceHierarchyEvent function. The vulnerability was disclosed on February 28, 2024, affecting the X.Org server implementation. The flaw occurs when certain new device IDs are added to the xXIHierarchyInfo struct, where it becomes possible to exceed the allocated array length (NVD).

The vulnerability is a heap buffer overflow condition that occurs in the XISendDeviceHierarchyEvent function. When a device with a given ID is removed and a new device with the same ID is added, the info structs might be written to the array of struct xXIHierarchyInfo twice, exceeding the size limit. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Red Hat).

The successful exploitation of this vulnerability could lead to multiple severe consequences including application crashes, remote code execution in SSH X11 forwarding environments, disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). For some distributions where Xorg runs with elevated privileges, this could also lead to local privilege escalation (NetApp).

The vulnerability has been confirmed to be exploitable in specific environments. Testing has shown that the exploit works on VirtualBox with VBoxVGA graphic controller but doesn't work if the OS is installed on VMware and default VirtualBox configurations. The vulnerability is particularly concerning in SSH X11 forwarding environments where it could lead to remote code execution (Bugzilla).

The vulnerability has been patched in multiple versions including xorg-server-21.1.11 and xwayland-23.2.4. Various Linux distributions have released security updates to address this vulnerability, including Red Hat Enterprise Linux versions 7, 8, and 9 through multiple security advisories (Red Hat).