CVE-2024-0409: Xorg-x11-server: selinux context corruption

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-18 · updated 2026-06-17
Weakness: CWE-787

Description

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

Affected products

Fedoraproject Fedora: 39
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux For Ibm Z Systems: 7.0
RedHat Enterprise Linux For Power Big Endian: 7.0
RedHat Enterprise Linux For Power Little Endian: 7.0
RedHat Enterprise Linux For Scientific Computing: 7.0
RedHat Enterprise Linux Server: 7.0
RedHat Enterprise Linux Workstation: 7.0
Kaspersky TigerVNC: before 1.13.1 — fixed in 1.13.1
xorg-x11-server: before 21.1.11 — fixed in 21.1.11
X.Org xwayland: before 23.2.4 — fixed in 23.2.4

How to fix

Upgrade to a fixed version: Kaspersky TigerVNC 1.13.1; xorg-x11-server 21.1.11; X.Org xwayland 23.2.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-0409 or the next vulnerability affects your stack