CVE-2024-21886

Name	CVE-2024-21886
Description	A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3721-1, DSA-5603-1, ELA-1040-1, ELA-1043-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xorg-server (PTS)	jessie, jessie (lts)	2:1.16.4-1+deb8u17	fixed
	stretch (security)	2:1.19.2-1+deb9u9	vulnerable
	stretch (lts), stretch	2:1.19.2-1+deb9u20	fixed
	buster, buster (lts)	2:1.20.4-1+deb10u15	fixed
	buster (security)	2:1.20.4-1+deb10u14	fixed
	bullseye	2:1.20.11-1+deb11u13	fixed
	bullseye (security)	2:1.20.11-1+deb11u14	fixed
	bookworm (security), bookworm	2:21.1.7-3+deb12u8	fixed
	sid, trixie	2:21.1.14-2	fixed
xwayland (PTS)	bookworm	2:22.1.9-1	vulnerable
	sid, trixie	2:24.1.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
xorg-server	source	jessie	2:1.16.4-1+deb8u15	ELA-1043-1
xorg-server	source	stretch	2:1.19.2-1+deb9u18	ELA-1040-1
xorg-server	source	buster	2:1.20.4-1+deb10u13	DLA-3721-1
xorg-server	source	bullseye	2:1.20.11-1+deb11u11	DSA-5603-1
xorg-server	source	bookworm	2:21.1.7-3+deb12u5	DSA-5603-1
xorg-server	source	(unstable)	2:21.1.11-1
xwayland	source	(unstable)	2:23.2.4-1

Notes

[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
https://lists.x.org/archives/xorg/2024-January/061525.html
https://gitlab.freedesktop.org/xorg/xserver/-/commit/bc1fdbe46559dd947674375946bbef54dd0ce36b
https://gitlab.freedesktop.org/xorg/xserver/-/commit/26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8
Regression: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1623