Public bug reported:
[Impact]
x0vncserver creates the framebuffer SysV shared memory segment with mode 0777
(world read/write) via shmget() in unix/x0vncserver/Image.cxx
(ShmImage::Init()).
Once a client connects and the server grabs the screen into that segment, any
local user can attach to it (shmat) and read or manipulate the contents of the
VNC server's screen, or crash the server.
This is a persistent exposure, not a narrow race window.
On the success path ShmImage::Init() does not remove the segment:
shmctl(IPC_RMID) is called only on shmat failure, on XShmAttach failure, and in
~ShmImage().
So the segment stays in the IPC namespace at mode 0777 for the entire lifetime
of x0vncserver, readable by any local user throughout.
CVE-2026-34352, Fixed upstream in 1.16.2.
[Test Plan]
Applies to Jammy, Noble, Resolute.
In a clean LXD container, as root, install the package and a probe that
attaches to a shm segment by id:
apt install -y tigervnc-scraping-server tigervnc-viewer xvfb
useradd -m attacker
cat > /tmp/shmprobe.py <<'EOF'
import ctypes, os, sys
shmid = int(sys.argv[1])
libc = ctypes.CDLL("libc.so.6", use_errno=True)
libc.shmat.restype = ctypes.c_void_p
libc.shmat.argtypes = [ctypes.c_int, ctypes.c_void_p, ctypes.c_int]
ctypes.set_errno(0)
addr = libc.shmat(shmid, None, 0o10000) # SHM_RDONLY
if addr == ctypes.c_void_p(-1).value:
e = ctypes.get_errno(); print("shmat FAILED: errno=%d (%s)" % (e,
os.strerror(e))); sys.exit(1)
print("shmat ATTACHED at 0x%x, first 32 bytes: %s" % (addr,
ctypes.string_at(addr, 32).hex()))
EOF
Start x0vncserver on a virtual display and connect a client so the
framebuffer is allocated (as root):
Xvfb :1 -screen 0 1024x768x24 &
x0vncserver -display :1 -SecurityTypes None -rfbport 5901 2>/tmp/x0vnc.log &
DISPLAY=:1 xtigervncviewer -SecurityTypes None localhost:5901 &
sleep 2
ipcs -m # the ~3 MB segment, owner root, nattch 2 (x0vncserver + X
server); note its shmid
As the attacker (a different uid), locate the segment and attach to it
(substitute the shmid from ipcs):
su - attacker -s /bin/sh -c "ipcs -m"
su - attacker -s /bin/sh -c "python3 /tmp/shmprobe.py <shmid>"
Before the patch:
* ipcs -m shows the segment with perms 777
* the attacker's shmat succeeds: "shmat ATTACHED ..." (a non-owner reads the
screen memory)
After the patch:
* ipcs -m shows the segment with perms 600
* the attacker's shmat fails: "shmat FAILED: errno=13 (Permission denied)"
* the connected viewer keeps receiving screen updates
[Where problems could occur]
One line in unix/x0vncserver/Image.cxx (shmget mode 0777 -> 0600); no
protocol, ABI, or config change, no reverse-dependency rebuild, and
Xvnc/Xtigervnc is a separate code path (unaffected).
The regression risk is when x0vncserver and the X server run under different
uids (e.g. x0vncserver as root against a seat-user Xorg): XShmAttach() now
fails on the 0600 segment.
This does not crash x0vncserver — ImageFactory::newImage() logs "Failed to
create SHM image, falling back to Xlib image" and uses the Xlib capture path,
so the effect is slower capture, not loss of function.
Cross-uid tooling that attached to the segment stops working, which is exactly
the fix.
[Other Info]
Upstream fix:
https://github.com/TigerVNC/tigervnc/commit/0b5cab169d847789efa54459a87659d3fd484393
** Affects: tigervnc (Ubuntu)
Importance: Undecided
Status: Fix Released
** Affects: tigervnc (Ubuntu Jammy)
Importance: Undecided
Assignee: Seyeong Kim (seyeongkim)
Status: In Progress
** Affects: tigervnc (Ubuntu Noble)
Importance: Undecided
Assignee: Seyeong Kim (seyeongkim)
Status: In Progress
** Affects: tigervnc (Ubuntu Resolute)
Importance: Undecided
Assignee: Seyeong Kim (seyeongkim)
Status: In Progress
** Also affects: tigervnc (Ubuntu Noble)
Importance: Undecided
Status: New
** Also affects: tigervnc (Ubuntu Resolute)
Importance: Undecided
Status: New
** Also affects: tigervnc (Ubuntu Jammy)
Importance: Undecided
Status: New
** Changed in: tigervnc (Ubuntu)
Status: New => Fix Released
** Changed in: tigervnc (Ubuntu Jammy)
Status: New => In Progress
** Changed in: tigervnc (Ubuntu Resolute)
Status: New => In Progress
** Changed in: tigervnc (Ubuntu Noble)
Status: New => In Progress
** Changed in: tigervnc (Ubuntu Resolute)
Assignee: (unassigned) => Seyeong Kim (seyeongkim)
** Changed in: tigervnc (Ubuntu Jammy)
Assignee: (unassigned) => Seyeong Kim (seyeongkim)
** Changed in: tigervnc (Ubuntu Noble)
Assignee: (unassigned) => Seyeong Kim (seyeongkim)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161717
Title:
tigervnc: x0vncserver exposes framebuffer shared memory to other local
users (CVE-2026-34352)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tigervnc/+bug/2161717/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
