A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
CVE-2024-0409
CVSS base score
7.8 (v3.1)
Severity
HIGH
Attack vector
Local
Weakness
CWE-787
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
tigervnc tigervnc
x.org x server
x.org xwayland
fedoraproject fedora
redhat enterprise linux
redhat enterprise linux desktop
redhat enterprise linux for ibm z systems
redhat enterprise linux for power big endian
redhat enterprise linux for power little endian
redhat enterprise linux for scientific computing
References
- access.redhat.com Third Party Advisory
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com Third Party Advisory
- bugzilla.redhat.com Issue Tracking, Third Party Advisory
- access.redhat.com Third Party Advisory
- access.redhat.com
- access.redhat.com