dbcve.org
FedoraOperating system · Fedoraproject

CVE-2023-6816

CRITICAL · 9.8 CVSS v3.1 Published 2024-01-18
Fix available
A fix is available. Upgrade to 21.1.11 / 23.2.4 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Heap overflow vulnerability in X.Org server's DeviceFocusEvent and XIQueryPointer reply handling. The server allocates buffer space based on the device's reported button count but fails to validate that button mappings stay within allocated bounds, allowing buttons mapped to values up to 255 to overflow the heap when the device has fewer buttons.

MitigationUpdate X.Org server to the patched version that properly validates button mapping values against allocated buffer sizes before processing DeviceFocusEvent and XIQueryPointer replies.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
FedoraOperating system
Affected:= 39
Enterprise Linux DesktopOperating system
Affected:= 7.0
Enterprise Linux ServerOperating system
Affected:= 7.0
Enterprise Linux WorkstationOperating system
Affected:= 7.0
Debian LinuxOperating system
Affected:= 10.0
X ServerApplication
Affected:< 21.1.11
XwaylandApplication
Affected:< 23.2.4

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify X server version
    Run 'Xorg -version' or check Xwayland version with 'Xwayland --version' or examine the installed package version via your package manager (e.g., 'rpm -q xorg-x11-server' or 'dpkg -l xserver-xorg-core')
    Affected if The installed version is lower than 21.1.11 for Xorg, or lower than 23.2.4 for Xwayland
  2. Check if X Input 2 (XI2) extension is enabled
    Run 'xinput list' to enumerate connected input devices, then use 'xinput list-props <device_id>' to check for XI2-related properties. XI2 is required for the vulnerable DeviceFocusEvent and XIQueryPointer code paths to be exercised.
    Affected if XI2-capable input devices are connected and active; the vulnerability triggers when these devices send specially crafted button mapping values
  3. Examine connected input device button configurations
    Use 'xinput list' to identify devices (especially mice, trackpads, graphics tablets), then query their button properties with 'xinput list-props <device_id>' focusing on 'Button Mapping' or similar properties
    Affected if A device reports fewer physical buttons but has button mappings referencing values up to 255, causing the heap overflow when the server uses these mappings without bounds checking
  4. Verify X server is processing XI2 events
    Monitor X server activity during normal use or enable X server debugging/logging. The vulnerable code paths in DeviceFocusEvent and XIQueryPointer are only reached when XI2 devices interact with the server.
    Affected if Users actively use XI2-capable input devices (touchpads, tablets, advanced mice) that trigger focus events or pointer queries

You are affected if your X server/Xwayland version is below 21.1.11/23.2.4 respectively AND you use X Input 2 devices with button mappings that exceed the device's physical button count.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 21.1.11 / 23.2.4 or later
Fixed in 21.1.1123.2.4
Interim mitigation

Update X.Org server to the patched version that properly validates button mapping values against allocated buffer sizes before processing DeviceFocusEvent and XIQueryPointer replies.

Recommended fix High confidence

X Server 21.1.11 or later; Xwayland 23.2.4 or later

  1. Identify the X Server and Xwayland packages installed on the system using the package manager (e.g., dnf for Fedora/RHEL, apt for Debian)
  2. For Fedora 39: Run 'sudo dnf update xorg-x11-server*' to update to version 21.1.11 or later which contains the fix
  3. For RHEL/CentOS Enterprise Linux (7.0): Run 'sudo yum update xorg-x11-server*' or 'sudo dnf update xorg-x11-server*' to apply the vendor patch
  4. For Debian 10.0: Run 'sudo apt update && sudo apt install xserver-xorg-core' to get the patched version
  5. For Xwayland: Update to version 23.2.4 or later which contains the fix
  6. After updating, restart the X server or reboot the system to load the patched version
  7. Verify the installed version matches or exceeds the fixed releases: X Server >= 21.1.11 and Xwayland >= 23.2.4
Caveat Upgrading the X server or display server components typically requires restarting the X session or rebooting the system; display manager restart may be needed

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Fedora Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing3.0 h
  • Review / QA1.0 h
8.0 hours of engineering $1,390
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,224.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-6816 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-6816 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data