A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access t
A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID…
| Vendor | Product | Versions |
|---|---|---|
| ? | ? | 21.1.0 |
| Red Hat | Red Hat Enterprise Linux 7 | 0:1.20.4-27.el7_9 |
| Red Hat | Red Hat Enterprise Linux 8 | 0:1.20.11-22.el8 |
| Red Hat | Red Hat Enterprise Linux 8 | 0:21.1.3-15.el8 |
| Red Hat | Red Hat Enterprise Linux 9 | 0:1.20.11-24.el9 |
| Red Hat | Red Hat Enterprise Linux 9 | 0:22.1.9-5.el9 |
| Red Hat | Red Hat Enterprise Linux 6 | unspecified |
| Red Hat | Red Hat Enterprise Linux 6 | unspecified |
| Red Hat | Red Hat Enterprise Linux 7 | unspecified |
| Red Hat | Red Hat Enterprise Linux 8 | unspecified |
| Red Hat | Red Hat Enterprise Linux 9 | unspecified |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.