3 ms·
To be fair, these are invalid attack vectors in the first place. Attackers automatically gain the full access to desktop sessions as soon as a connection is mad
by esjeon 3y ago
To be fair, these are invalid attack vectors in the first place. Attackers automatically gain the full access to desktop sessions as soon as a connection is made to the X server. It's already vulnerable by design, so there's almost no need to look for exploits.
p.s: So, all in all, this doesn't exactly make Xorg more dangerous than before, especially w/ rootless X being widely used.
- m000 3y agoSo, I guess this is another instance of the "bogus CVE problem" [1]? I.e. people upselling discovered bugs/vulnerabilites for "street cred". [1] https://news.ycombinator.com/item?id=37608110 https://news.ycombinator.com/item?id=37608110
- kevincox 3y agoYeah, rootless is key here. This allows RCE, but that is usually not valuable because the X server is running with the same permissions as the application. However these vulnerabilities are old enough that they would have been useful when X always ran as root.
- tetha 3y agoMh. Though at that point you might be looking at desktop computers, and access to the current users file might be good enough. Sure, you can't install printer drivers via non-root X servers, but you can probably exfiltrate their local browser data (credit to XKCD[1]). It's another hole where vulnerability assessment is kinda... wonky. 1: https://xkcd.com/1200/ https://xkcd.com/1200/