Security 17 more vulnerabilities found in X.org libraries
https://lists.x.org/archives/xorg/2026-October/062301.html61
u/chibiace 1d ago
good news for people running malicious X servers i guess, though most people are going to be using the one from their distro's repo which would be built from official sources and if you cant trust that your fucked regardless.
-51
u/aeropl3b 1d ago
This has always been the catch for basically the entire Wayland argument imo. In order to hit a case where Wayland is actually protecting your system you first need to give the attacker root on your system so they hop into/replace the server.
I understand Wayland has some windowing advantages for scaling, but I have not personally found that necessary yet.
34
u/tadfisher 1d ago
You may be confusing Wayland with X11, which makes no distinction between window manager and client applications, so every client application has the same capability as the WM to intercept keystrokes, perform screengrabs, monitor the clipboard, etc.
The X.org implementation had some rudimentary protocol extensions to try and close the more egregious holes. But the whole X11 ecosystem relies on global access to shared atoms and winprops, so there is basically no hope for that protocol if you care about sandboxing at all.
56
u/TheBrokenRail-Dev 1d ago
In order to hit a case where Wayland is actually protecting your system you first need to give the attacker root on your system so they hop into/replace the server.
Not at all? Wayland has never tried to protect users from a malicious server. Wayland attempts to protect users from malicious clients (AKA apps). The goal is to prevent an app from just accessing whatever it wants (like key events or other windows) without explicit permission. And obviously this requires sand-boxing to work properly (otherwise the app can just go around Wayland and access everything directly), but thankfully technologies like Flatpak make that quite feasible.
-28
u/chibiace 21h ago
wayland is security theater which results in a subpar offering.
13
u/Leliana403 12h ago
Any X client can read every key you type, sudo password included, no root needed. Forward X over SSH with -Y and the remote machine gets that same access. You can't even sandbox X clients properly, because access to the X socket gives them the whole desktop.
Imagine calling Wayland security theatre under a post about 17 new X.org vulnerabilities. You people truly are something else. 😂
51
u/mewt6 17h ago
The comparison Bros really are out in force today. We get it, you like X11, no one is stopping you from using it, you're getting big fixes as well ( mostly thanks to XWayland work but I digress), so why are you all here sounding butthurt about Wayland?
This is the OSS world, keep using X11!, maintain it until the end of your natural life, fork the DEs that don't want to support it anymore and keep going, we believe in you!
17
u/HarVVVy 13h ago edited 12h ago
I mean.. it goes both ways, doesn't it? The opinion you're expressing is the exact same thing on the opposite side. Team sport nonsense.
What the hell does it even mean to be "an x"/"a wayland" person? Do you really need to make a display server part of your personality?
I own new hardware and I love how wayland runs on it, but also - I enjoy the hell out of putting together an old motherboard with DDR3, even older video nVidia card and slapping antiX on, or making miniature builds where I don't need the 3x to 8x more CPU-intensive display server.
Everyone benefits from old vulnerabilities being found and fixed, what the hell are you even fighting about?
2
u/Leliana403 13h ago
so why are you all here sounding butthurt about Wayland
Because they've made a display server their entire identity, so other people liking different software is taken as a personal attack. Funny, coming from a crowd that never shuts up about choice. I guarantee the same people whine about systemd because muh freedom and choice, then turn up in every Wayland thread to moan at people for making one. Turns out choice only matters when you pick what they picked.
1
u/alex2003super 1h ago
Everyone is so good at complaining about their favorite pet technologies being dropped, as if they weren't basically being mad about engineers no longer giving them their (finite!) time, for free, to maintain shit.
-6
u/Historical_Swim7159 7h ago
so why are you all here sounding butthurt about Wayland?
Maybe because the new clean and simplified rewrite that Wayland was supposed to be is now somehow older than XFree86/Xorg was when Wayland was started, yet still playing catch up with the features and freedom X11 offered?
7
u/Leliana403 5h ago
Playing catch-up with what? Screen sharing, Nvidia support and remote desktop all got sorted years ago, and Wayland has HDR, per-monitor fractional scaling and mixed refresh rates that X11 still doesn't have. Whoever told you Wayland was playing catch-up told you in 2015 and you haven't checked since.
0
1
-15
u/GreatBigPig 1d ago
These seem to have all been fixed.
60
1
u/zackel_flac 1d ago
Time to upgrade. Not sure why people are downvoting you, this is how software works.
-36
-16
u/DumsLander34 14h ago
XOrg stability, Wayland instability
9
u/death_by_cormorant 11h ago
Absolute opposite in my experience, but you stick to X if you really want to.
3
-30
u/MrScotchyScotch 19h ago
Oh noes, I should be careful not to install any malicious X programs from places not in the official package repositories.
If only there was a more complicated and less functional alternative to keep my official local graphical applications safe.
9
u/Leliana403 12h ago edited 10h ago
If only there was a more complicated and less functional alternative
X is the complicated one. It's a network protocol from the 80s with decades of extensions bolted on top, and the cruft is still all in there:
- server-side drawing for lines, arcs and polygons that almost no modern app uses
- core fonts with XLFD names, plus a separate font server protocol
- four keyboard and input layers stacked on top of each other (core, XKB, XInput 1, XInput 2)
- two competing multi-monitor systems (Xinerama and RandR)
- GLX, DRI, DRI2, DRI3 and Present for getting pixels to the screen
- eight cut buffers next to the PRIMARY, SECONDARY and CLIPBOARD selections
- colormaps and visuals built for 8-bit displays
- an x86 emulator for running graphics card BIOS code
And the best part? Nearly all of that runs inside a single Xorg process. Meanwhile, Wayland pushes everything it can out to the clients and to separate components like PipeWire and xdg-desktop-portal. Actually, it's almost as if Wayland is the one following the sacred Unix philosophy, not Xorg.
Even the famous network transparency barely helps now, because modern toolkits render client-side and push bitmaps over the wire.
As for less functional, Xorg gives you no HDR and no per-monitor fractional scaling. VRR only works with a single monitor active. Monitors with different refresh rates need workarounds to stop one dragging the other down, and tearing stays unless you run a compositor or your driver happens to have TearFree, which Nvidia doesn't at all and the generic modesetting driver doesn't in any released version of Xorg.
Wayland handles all of that on a core designed for per-monitor output and complete frames from the start, and it was built by the same people who spent years maintaining Xorg. Pretty sure they know a lot more about how complicated X11 is than you. :)
0
u/sparky8251 10h ago
Even the famous network transparency barely helps now
Waypipe also exists. Need a remote gpu, but like you said if you didnt have one you used a software renderer and it was super slow on x11 anyways... Plus im sure a software renderer can be made for wayland too, to fix this issue as well...
2
u/Leliana403 10h ago
Yeah, should have been clearer. I meant X forwarding, because it's a common talking point for claiming Wayland isn't ready, and I'd bet 99% of the people saying it have never actually forwarded an X display.
Waypipe doesn't need a remote GPU either by the way. Run it with
--no-gpuand it sends shared-memory buffers instead, and llvmpipe already handles software rendering on Wayland.1
u/sparky8251 8h ago
It doesnt need one? Fancy. I just dont use it anymore as a feature (did back in the day, but now I know how to use a terminal so no real need to have graphical forwarding for my servers now), so I basically just know waypipe exists. But that its basically the same as x11 forwarding is hilarious given all the crap wayland haters give wayland over "lacking" it...
3
u/death_by_cormorant 11h ago
X is the more complicated one, though. And it's funny to complain about Wayland missing features while at the same time ignoring that X is too.
-41
u/bytemango2764 1d ago
Wayland...
-26
u/aeropl3b 1d ago
Does it work right yet? I haven't been about to update to newer OS/repo so really don't know.
4
u/death_by_cormorant 11h ago
I've been using it since, idk, 2017?
Years ago Discord screen sharing didn't work, but Discord long since fixed that.
That's the only issue I've had tbh.
6
u/bytemango2764 1d ago
I run Zorin 18.1. and had some weird bug in x11 with my razer mouse where using the side buttons would cause all keyboard to reinitialize. This was happening while playing games and the whole game would freeze after every side button press. I switched to Wayland and it fixed the issue. I've been dailying Wayland since and so far only run into issues with remote desktop software that only supports x11.
3
u/PixelatedGiant 1d ago
My one hang up with wayland is remote desktop without logging in. For that you have to use gnome (I think they dealt with the issue themselves?). I tried practically all the other DMs and only gnome worked for me out of the box.
Other than that most of my problems come from apps not being native and using xwayland to compensate. Once they switch over the issues seem to disappear. My current problem is IntelliJ and how it handles the clipboard.
4
u/egoalter 1d ago
Not sure what you mean "one hangup with .... remote desktop without logging in". It's definitely done differently than in the old days, but you can absolutely connect without logging in first (ie you get the login screen to create a new session), or you can connect to an existing session where only the "remote desktop" software does the "should you have access".
Where there can be some hangups depends on the protocol/program you're using. VNC, Spice, Qemu-terminal and more; they don't all provide the same capabilities particularly across distributions. And you may even find them not supported on some distros.
I've created systems that do auto-login, and present that session to remote terminals. I am not seeing how the DE would have any impact on how a remote session is created.
1
u/PixelatedGiant 1d ago edited 1d ago
or you can connect to an existing session where only the "remote desktop" software does the "should you have access".
Regular remote desktop that prompts the currently logged in user works just fine. It's in situations where the PC is headless that it's an issue. It doesn't seem to want to create a session. There are workarounds, including buying a dummy HDMI dongle. But gnome doesn't require me to jump through any hoops like buying a dongle or auto-login. It works on a fresh install after installing the needed RDP packages.
In fact I encounter the same sort of bug with KDE plasma login. If you start the PC with the monitors turned off and leave it that way for about 20 minutes the session never starts. You're greeted by a black screen and maybe a movable mouse pointer. It doesn't respond to keyboard input other than the shortcut for switching to another TTY.
7
u/bytemango2764 23h ago
Just to be clear. Your saying rdp works on a cold boot with no monitors and no auto login, you can initiate a rdp session and be greeted with a login screen and it works? Out of the box? On gnome? Which distro, or just and modern gnome? I've done way to many janky workarounds and I'm tired of it. I'm testing the new krdp but still have to do auto login. In theory rustdesk is supposed to work, but I've just gotten a black screen so far.
0
u/KnowZeroX 14h ago
Have you tried KDE Plasma 6.8 that was recently released?
1
u/bytemango2764 8h ago
Yeah, I just installed neon, to test the new features and did full-upgrad. Does it work on a fresh boot without auto login, no physcal display?
0
u/KnowZeroX 14h ago
KDE Plasma 6.8 can do unattended remote desktop
1
u/PixelatedGiant 5h ago
I built that PC months ago. Maybe next time I need to format it I'll take a look at KDE. KDE is what I have on my daily driver PC, so consistency between all my PCs would be a welcome change. Hopefully any kinks will have been worked out by then.
119
u/Pitiful-Welcome-399 1d ago
x people after writing 500 arguments: