CVE-2020-29074
📋 TL;DR
This vulnerability in x11vnc 0.9.16 allows unauthorized access to shared memory segments due to insecure permissions (IPC_CREAT|0777) in shmget calls. It affects users running x11vnc with shared memory enabled, potentially exposing sensitive screen data or allowing privilege escalation. Attackers with local access can exploit this to read or modify shared memory intended for the current user only.
💻 Affected Systems
- x11vnc
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
X11vnc by X11vnc Project
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains unauthorized access to shared memory, leading to information disclosure of screen contents, session hijacking, or privilege escalation if x11vnc runs with elevated privileges.
Likely Case
Local attackers read sensitive data from shared memory, such as screen captures or authentication details, compromising user privacy and potentially enabling further attacks.
If Mitigated
With proper access controls (e.g., patched versions or restricted permissions), impact is minimized to no unauthorized access, maintaining confidentiality and integrity.
🎯 Exploit Status
Exploitation requires local access to the system; no public proof-of-concept has been disclosed, but the vulnerability is straightforward to abuse.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 69eeb9f7baa14ca03b16c9de821f9876def7a36a; check for updated packages from distributions like Debian or Fedora.
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2020/12/msg00018.html
Restart Required: Yes
Instructions:
1. Update x11vnc to a patched version via your package manager (e.g., apt-get update && apt-get upgrade x11vnc on Debian). 2. Restart the x11vnc service or process to apply changes.
🔧 Temporary Workarounds
Disable shared memory scanning
linuxConfigure x11vnc to not use shared memory for screen scanning, reducing the attack surface.
x11vnc -noshm
🧯 If You Can't Patch
- Restrict access to x11vnc processes by running with minimal privileges and isolating them in containers or virtual machines.
- Monitor system logs for unauthorized access attempts to shared memory segments and implement strict access controls on IPC resources.
🔍 How to Verify
Check if Vulnerable:
Check x11vnc version: run 'x11vnc -version' and verify if it is 0.9.16 or earlier; inspect source code for shmget calls with IPC_CREAT|0777.Check Version:
x11vnc -version 2>&1 | grep -i versionVerify Fix Applied:
After updating, confirm the version is patched (e.g., post-commit 69eeb9f7baa14ca03b16c9de821f9876def7a36a) and test that shared memory permissions are secure.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to shared memory segments in system logs (e.g., /var/log/syslog).
Network Indicators:
- Not applicable, as this is a local vulnerability; focus on host-based indicators.
SIEM Query:
Example: search for process creation events related to x11vnc with shared memory flags, or monitor for IPC permission changes.🔗 References
- https://github.com/LibVNC/x11vnc/commit/69eeb9f7baa14ca03b16c9de821f9876def7a36a
- https://lists.debian.org/debian-lts-announce/2020/12/msg00018.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2FLWSVH32O6JXLRQBYDQLP7XRSTLUPQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MHVXHZE3YIP4RTWGQ24IDBSW44XPRDOC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZL6NQTNK5PT63D2JX5YVV5OLUL76S5C/
- https://www.debian.org/security/2020/dsa-4799
- https://github.com/LibVNC/x11vnc/commit/69eeb9f7baa14ca03b16c9de821f9876def7a36a
- https://lists.debian.org/debian-lts-announce/2020/12/msg00018.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2FLWSVH32O6JXLRQBYDQLP7XRSTLUPQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MHVXHZE3YIP4RTWGQ24IDBSW44XPRDOC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZL6NQTNK5PT63D2JX5YVV5OLUL76S5C/
- https://www.debian.org/security/2020/dsa-4799
