CVE-2024-31080: X.org Server Buffer Overflow Vulnerability

CVE-2024-31080 Overview

A heap-based buffer over-read vulnerability was discovered in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash.

Critical Impact

Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads, leading to information disclosure and denial of service conditions.

Affected Products

• X.org Server (xorg-server)
• Red Hat Enterprise Linux (multiple versions)
• Fedora Linux distributions
• Debian Linux distributions

Discovery Timeline

• April 4, 2024 - CVE-2024-31080 published to NVD
• August 4, 2025 - Last updated in NVD database

Technical Details for CVE-2024-31080

Vulnerability Analysis

The vulnerability resides in the ProcXIGetSelectedEvents() function within the X.org server codebase. This function handles requests from X Input extension clients to retrieve selected events. The flaw is classified as CWE-126 (Buffer Over-read), which occurs when the software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

The root cause stems from improper handling of byte-swapped length values when processing replies for clients with different endianness. When a client connects to the X server from a system with opposing byte order (e.g., big-endian client to little-endian server), the length values in the protocol messages must be byte-swapped. The vulnerability occurs because the server incorrectly uses these swapped values to determine how much memory to read and transmit back to the client.

Root Cause

The vulnerability exists due to improper bounds checking when handling byte-swapped length values in the XI (X Input) extension's ProcXIGetSelectedEvents() function. When length values are byte-swapped for clients with different endianness, the resulting values can be interpreted as much larger than intended. This causes the X server to read beyond the bounds of allocated heap memory, exposing sensitive data that happens to be stored in adjacent memory regions.

Attack Vector

This is a local attack vector vulnerability requiring the attacker to have local access to establish a connection to the X server. The exploitation scenario involves:

1. An attacker establishes a connection to the vulnerable X server from a system with different endianness
2. The attacker sends crafted XI extension requests that trigger the ProcXIGetSelectedEvents() function
3. Due to byte-swapping issues, the server misinterprets length values and reads beyond allocated buffer boundaries
4. The server transmits the out-of-bounds heap memory contents back to the attacker
5. This process continues until the server hits an unmapped memory page, causing a segmentation fault and crash

The attack does not allow the attacker to control which specific memory regions are read, but the over-read can still expose sensitive information stored in heap memory near the targeted buffer.

Detection Methods for CVE-2024-31080

Indicators of Compromise

• Unexpected X server crashes with segmentation fault errors in logs
• Abnormal memory access patterns from the Xorg process
• X server process terminating unexpectedly during client connections from systems with different byte order architectures

Detection Strategies

• Monitor X server logs for segmentation faults or memory access violations related to XI extension handling
• Implement memory debugging tools such as AddressSanitizer (ASan) in development environments to detect heap buffer over-reads
• Review X server connection logs for unusual connection patterns from cross-endianness clients

Monitoring Recommendations

• Configure system monitoring to alert on X server process crashes and restarts
• Enable core dump analysis for X server segmentation faults to identify exploitation attempts
• Monitor network connections to the X server for anomalous client behavior

How to Mitigate CVE-2024-31080

Immediate Actions Required

• Apply security patches from your Linux distribution vendor immediately
• Review and restrict X server access to trusted local users only
• Consider disabling remote X server connections until patches are applied
• Implement network segmentation to limit exposure of systems running vulnerable X server versions

Patch Information

Multiple Linux distributions have released security advisories and patches for this vulnerability. Organizations should apply the appropriate patches based on their distribution:

• Red Hat Enterprise Linux: Multiple advisories including RHSA-2024:1785, RHSA-2024:2036, RHSA-2024:2037, and others. See Red Hat CVE-2024-31080 for complete details.
• Debian: Security update available via Debian LTS Announcement
• Fedora: Package updates announced via Fedora Package Announcements

For additional technical discussion, refer to the OpenWall OSS-Security mailing list.

Workarounds

• Restrict X server access using xhost or X authorization mechanisms to limit connections to trusted clients only
• Disable the X Input extension if not required by your applications (may impact functionality)
• Use Wayland-based display servers as an alternative where supported by your applications
• Implement additional access controls using SELinux or AppArmor to restrict X server process capabilities

# Restrict X server to local connections only
xhost -
xhost +local:

# Verify X server version for patching
Xorg -version

# Check for available security updates (Red Hat/CentOS)
yum check-update xorg-x11-server*

# Check for available security updates (Debian/Ubuntu)
apt list --upgradable | grep xorg