X.org Security Advisory: multiple security issues X.Org X server and Xwayland

https://lists.x.org/archives/xorg-announce/2025-October/003635.html

by birdculture • 9 months ago

207 196 9 months ago

lists.x.org

rwmj• 9 months ago

Good that people are finding and fixing these, but basically allowing any untrusted client to talk to your X server is asking for trouble just by design. (Bonus points if you have any Tcl/Tk apps running, where you can simply transmit commands for the program to run via the X server.)

jeroenhd3• 9 months ago

There are plenty of setups where the X server runs at higher privileges/on a different host than the (partially trusted) application that might exploit the X server. This is a classic elevation of privileges vulnerability in those setups.

X11's practical absence of any security mechanisms for user sessions means you should probably not run any kind of low-trust UI program anyway, as there is no prevention of keystroke injection or screen recording, but that's a design flaw that will never be solved. That doesn't mean that EoP style attacks like these should be ignored or underestimated, though.

mrktf• 9 months ago

Digging deeper there are mechanisms for long time on internal X side (see https://www.x.org/releases/X11R7.6/doc/xorg-docs/specs/Xserv... ) - granted never seen it practically implemented.

And going to rabbit hole there are even proof of concept security implementation named Xnamespace for Xorg fork (needs polishing and much more patches but looks doable. see wip documentation: https://raw.githubusercontent.com/X11Libre/xserver/d2b60a3d6... )

uecker10• 9 months ago

X11 had the distinction between trusted and untrusted X11 clients basically forever. But nobody bothered to even spend the minimal amount of work to make this usable in practice^1. This had two reasons: 1.) It is irrelevant when you run the programs as the same user so nobody bothered (and no: Wayland does not help: https://github.com/Aishou/wayland-keylogger) 2.) It is more fun to simply pretend it is unfixable broken and write something new (something any good engineering manager should have stopped immediately).

¹. I used to use this and also fixed some bugs in some programs. The main problem when I last checked a decade ag was that some important extensions such as composite would need to be exposed to untrusted clients.

mikkupikku5• 9 months ago

I don't think I've seen X configured to run as root in probably 15 years. If anybody still does anything like that, they're literally asking for it.

0xbadcafebee2• 9 months ago

Why do people keep persisting this myth? X11 has authentication. You can either rely on filesystem permissions, or a shared secret. The same way thousands of other network servers work.

Any program you run on a computer (especially a Linux computer, which lacks modern OS security measures and has constant privesc kernel holes) exposes you to security flaws. There has yet to be any computer system designed that a hacker can't break out of. If you intentionally download and execute a program, you are rolling the dice, regardless of what the software is.

What's insane about all these discussions is that NOBODY IS HACKING X SERVERS. There's a thousand other kinds of software on Linux that there is real malware for. But nobody is trying to hijack your X11 session. This imagined threat is a red herring designed to bolster the argument for Wayland's horrible designs.

udev40962• 9 months ago

Any application can literally log EVERYTHING! It's good to see wayland getting better everyday

shrubble• 9 months ago

Solaris had Trusted Extensions for X11 which shipped with Trusted Solaris 8.

In 2000.

Solaris 10 had it built into the base OS and integrated into both the CDE and GNOME desktops they shipped. With OpenSolaris it was released as open source under the non-GNU CDDL license.

In November 2006.

Wayland was started in 2008.

enriquto• 9 months ago

X11's practical absence of any security mechanisms for user sessions means you should probably not run any kind of low-trust UI program

This has nothing to do with X11 or even UI at all. You should not run any low-trust program whatsoever (outside of a container). Any program that runs as your user can change your ~/.bashrc or any other file on your homedir.

Of course this is a feature that you want, for example when you edit these files with a text editor.

exasperaited2• 9 months ago

Bonus points if you have any Tcl/Tk apps running, where you can simply transmit commands for the program to run via the X server.

Back in 1996 the level of X integration in Tk was awesome; I had a shell tool that could make Netscape do stuff by firing MIT magic cookies at it.

In a contemporary setting, it's pretty horrifying.

ptx• 9 months ago

Didn't Netscape use Motif?

shevy-java2• 9 months ago

Some oldschool legends are still fixing bugs in xorg.

Alan Coopersmith in particular. He even fixed a bug I reported. :)

(I forgot in which app it was but the bug report should be somewhere still; it is not old, perhaps 2 years ago or 3 years ago. The xorg app in question behaved oddly when doing "--version". I only noticed this because I wrote a ruby script that displays which version of programs are installed, and that one kept on making problems, whereas the others worked fine. After I reported it, Alan fixed this very quickly. I think it was some missing flag in the C program or something like that; right now I can not remember the name of the program ... my brain tries to say xrandr but I think it was not xrandr but a less frequently used program somewhere in the FTP listing ...)

ElectroBuffoon2• 9 months ago

Keith Packard, another legend, was proposing X11 improvements in 2018. [0] He doesn't seem to be paid to work in X11 or Wayland, thus being free to float ideas he likes.

[0] https://keithp.com/x-ideas/

bitwize• 9 months ago

These are all "no way to prevent this, say users of only language where this regularly happens" type problems though.

The send command in Tk is lel, but can easily be effectively closed by rebinding it to a no-op.

hulitu2• 9 months ago

You do realize that your web browser is executing code feeded by remote servers (RCE). But it is important to fix the windowing system. /s

samtheprogram• 9 months ago

Would Fil-C have prevented the first or third?

pizlonator2• 9 months ago

By my reading, it would have prevented all of them.

dingdingdang• 9 months ago

Wonder how these play out against the https://github.com/X11Libre/xserver base, would be interesting to hear from that end as to how these things are handled. My understanding is that they address any sec issues that arise on x.org but it would be fascinating if the issues are already mitigated since XLibre updated their xserver port with 1000s of issues that were never addressed on the x.org side of things.

richard_todd• 9 months ago

On their github you can see all three changes identical to x.org's happened on October 28th (same day as the advisory). So, they were not already fixed, but the fixes were applied immediately.

themerone• 9 months ago

That project is a pipe dream. They don't have what it takes to continue X11 alive once X.Org pulls the plug.

mmcgaha• 9 months ago

I bet you are the life of the party. Seriously though, what makes you write that so matter of factly?

asveikau3• 9 months ago

That's the fork where the primary cause was to be "anti-woke", right? Honestly it seemed like it was just because that one guy was a little unbalanced, and he happened to be channeling that energy into an X server fork.

nofriend4• 9 months ago

no the primary cause was that the main xorg project wasn't accepting the devs patches any more.

cassepipe• 9 months ago

On the github, he points to this document:

https://github.com/X11Libre/xserver/blob/master/HISTORY.md

Doesn't mention "woke" but the style is reminiscent to me from grandiosity/paranoia issues

forgotpwd16• 9 months ago

XLibre looks nice with lots of work happening in only 5mo.

immibis5• 9 months ago

The problem with XLibre is political, not technical. When they came out they made a big deal of being the anti-woke free-speech no-vaccine-mandate alternative to woke cancel-culture Xorg, which instantly ruined their reputation before it even began.

kevin_thibedeau• 9 months ago

Coverity is pretty good about finding these kinds of bugs. Is there a reason why a project as significant as Xorg isn't taking advantage of their gratis access for that tool?

josteink2• 9 months ago

I think the short story is that the people who develop Wayland are the people who used to develop Xorg.

And they’d rather spend their energy on giving you a compelling reason to switch, rather than using it to add to the reasons for staying on a project they now consider obsolete.

You may disagree with their assessment, but you can’t blame them for how they decide to prioritize.

krautburglar• 9 months ago

I don’t think that is necessarily true. Most of the work goes way back (1984), done by people who have been retired for a long time now. Then in the late ‘00s redhat’s x11 maintainers (i.e. young people who were hired to fix bugs, not original developers) intimated that with DRI/DRM, x11 had become mostly obsolete, and that they needed to start over, so we got wayland. All I would add to that is that if they were correct, rather than conjuring an excuse to write their own thing, everyone would have jumped to wayland over a decade ago, but here we are, 17 years later, the benchmarks are still weak, and people are still squabbling. seems more like JWZ’s CADT than anything else.

justin667• 9 months ago

I think the short story is that the people who develop Wayland are the people who used to develop Xorg.

They certainly say that to people a lot. Oftentimes the person saying it is young enough that I wonder how much time they spent working on X.

shevy-java2• 9 months ago

Don't kill xorg! :(

ekvintroj• 9 months ago

The main pain in linux is graphics. It's a shame.

goneri• 9 months ago

Xorg is indeed a lot of painful complexity. This being said, the software is not Linux specific, and for modern Linux distributions, it is more and more a legacy technology.

immibis5• 9 months ago

Our chief pain is graphics... graphics and audio... audio and graphics... our two pains are audio and graphics... and wifi hardware support... Our three pains are audio, graphics, and wifi hardware support, and an almost fanatical devotion to the command line.... Our four... no... Amongst our pains... are such elements as graphics, audio.... I'll come in again.

ethmarks• 9 months ago

Nobody expects the Linux distribution!

pluc• 9 months ago

Graphics is the reason Linux got over 1% desktop market share. When you have a problematic piece of hardware, sure, it sucks. But most setups will run Steam games near native quality out of the box. I'd blame the hardware not Linux.

pizlonator2• 9 months ago

Considering how nicely Weston with SW rendering runs in Fil-C, I bet that the X server will run fine in Fil-C, too.

Fil-C exhibits the lowest overhead in code that spends its time on primitive bits.

Fil-C exhibits the highest overhead in code that chases pointers.

I'm assuming X is the former. Weston seems to be.

sylware2• 9 months ago

_Roughtly_ speaking, X11 is only there for old games and the steam client. It is even worse with the steam client since the main executable in still 32bits.

hulitu2• 9 months ago

_Roughtly_ speaking

_Strictly_ speaking X11 is only there because, after all those years, Wayland still does not meet expectations.

sylware2• 9 months ago

huh? Nope. x11 is here only for legacy support... and that valve client (which master binary is still a 32bits executable hardcoded on x11 and GL).

Razengan2• 9 months ago

How did Twitter get away with taking X.com?

If it was the other way around, would an open source or whatever project have been able to take Twitter.org?

bastawhiz• 9 months ago

It was from x.com in the late 90s, merged with PayPal, Elon took the domain with him.

Razengan2• 9 months ago

Ah forgot about that. Didn't think it'd predate x.org

X.org Security Advisory: multiple security issues X.Org X server and Xwayland

Related Stories