CVE-2024-31083: 
TigerVNC vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2024-31083) was discovered in the ProcRenderAddGlyphs() function of Xorg servers. The vulnerability was introduced prior to X11R6.7 (2004) and affects Xorg servers and Xwayland implementations. The issue was fixed in xorg-server 21.1.12 and xwayland 23.2.5 (X.Org Advisory).

The vulnerability occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server. AllocateGlyph() returns a new glyph with refcount=0 and a re-used glyph would not change the refcount. This results in multiple entries in the glyph_new array pointing to the same non-refcounted glyphs. When ProcRenderAddGlyphs() frees a glyph, it leads to a use-after-free condition when the same glyph pointer is subsequently accessed. The vulnerability has a CVSS v3.1 base score of 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (Red Hat CVE).

This vulnerability allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request (NVD).

The vulnerability requires local access and can be exploited by an authenticated attacker. The attack complexity is low, requiring no user interaction to exploit (Red Hat CVE).

The vulnerability has been patched in xorg-server version 21.1.12 and xwayland version 23.2.5. A regression was later discovered in the initial fix and was addressed in xorg-server-21.1.13 and xwayland-23.2.6 (OSS Security). For Xwayland versions 23.1 and later, byte-swapping support is disabled by default, which provides protection against this issue unless the Xwayland server is started with the +byteswappedclients option.