Cyber Resilience

CVE-2023-3138

Memory Safety in Redhat Enterprise Linux 8.0 … 9.0

Published
28 June 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.017 74th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2023-3138 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 26% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those…

more

functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.

CWE(s)

Related Threats

CVEs Like This One

CVE-2023-43785Same product: Redhat Enterprise Linux
CVE-2025-26597Same product: Redhat Enterprise Linux
CVE-2023-1073Same product: Redhat Enterprise Linux
CVE-2023-1729Same product: Redhat Enterprise Linux
CVE-2023-6228Same product: Redhat Enterprise Linux
CVE-2023-40661Same product: Redhat Enterprise Linux
CVE-2023-3812Same product: Redhat Enterprise Linux
CVE-2023-2977Same product: Redhat Enterprise Linux
CVE-2023-3164Same product: Redhat Enterprise Linux
CVE-2023-4692Same product: Redhat Enterprise Linux

Affected Assets

x.org
libx11
≤ 1.8.6
redhat
enterprise linux
8.0, 9.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V17.3.2

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-119 CWE-787

Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.

addresses: CWE-119

Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.

addresses: CWE-119

Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.

addresses: CWE-119

Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (bounds checking, safe APIs, reviews) directly prevent this class of flaw.

ID.RA-01 partial match
prevents

Vulnerability scanning and code analysis directly surface buffer-boundary flaws.

ID.RA-08 partial match
prevents

Receiving and triaging vulnerability disclosures commonly includes buffer-related reports.

PR.AT-02 partial match
prevents

Developer training on secure coding reduces introduction of memory-buffer errors.

PR.PS-02 partial match
prevents

Patching replaces vulnerable code containing buffer-boundary defects.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development catches out-of-bounds accesses before release, covering most instances of the weakness.

prevents

Secure development lifecycle mandates memory-safety practices that directly prevent buffer-boundary violations.

prevents

Application security requirements can specify memory-safety rules, but do not prescribe implementation details.

prevents

Secure architecture and engineering principles include memory-safe design patterns that mitigate buffer overflows.

prevents

Secure coding standards explicitly forbid unsafe buffer operations, directly eliminating CWE-119.

prevents

Change management can enforce review gates that catch unsafe memory operations before deployment.

References