CVE-2024-21886: 
TigerVNC vulnerability analysis and mitigation

A heap buffer overflow vulnerability (CVE-2024-21886) was discovered in the DisableDevice function in the X.Org server. The vulnerability was identified in early 2024 and affects X.Org server implementations. This security flaw impacts various Linux distributions and their X server components (NVD).

The vulnerability occurs in the DisableDevice() function when an enabled device is disabled. The issue stems from a problematic link/unlink operation during recursive calls to DisableDevice(), which leads to a mismatch between the total number of devices and the number of devices in the list. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Red Hat).

The vulnerability can lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments. For some distributions where Xorg runs as root under specific display drivers, it can also result in local privilege escalation (Bugzilla).

The vulnerability has been confirmed to be exploitable in specific environments. Testing has shown that the exploit works on VirtualBox with VBoxVGA graphic controller but doesn't work if the OS is installed on VMware and default VirtualBox configurations (Bugzilla).

Multiple vendors have released patches to address this vulnerability. Red Hat has released security updates for affected versions across RHEL 7, 8, and 9 distributions through various security advisories. The vulnerability has been fixed in xorg-server version 21.1.11 and xwayland version 23.2.4 (Red Hat).