Log in Start free

Vulnerability · Published Sep 1, 2022 · Assigned by redhat

CVE-2022-2320

High 7.8

In plain English

A high-severity out-of-bounds write in xorg-x11-server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.6%top 49.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of root.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8xorg-x11-server-Xdmx1.20.11-9.el8ALSA-2022:7583
AlmaLinux:9xorg-x11-server-Xdmx1.20.11-11.el9ALSA-2022:8221
AlmaLinux:8xorg-x11-server-Xephyr1.20.11-9.el8ALSA-2022:7583
AlmaLinux:9xorg-x11-server-Xephyr1.20.11-11.el9ALSA-2022:8221
AlmaLinux:8xorg-x11-server-Xnest1.20.11-9.el8ALSA-2022:7583
AlmaLinux:9xorg-x11-server-Xnest1.20.11-11.el9ALSA-2022:8221
AlmaLinux:8xorg-x11-server-Xorg1.20.11-9.el8ALSA-2022:7583
AlmaLinux:9xorg-x11-server-Xorg1.20.11-11.el9ALSA-2022:8221
AlmaLinux:8xorg-x11-server-Xvfb1.20.11-9.el8ALSA-2022:7583
AlmaLinux:9xorg-x11-server-Xvfb1.20.11-11.el9ALSA-2022:8221
AlmaLinux:8xorg-x11-server-Xwayland21.1.3-6.el8ALSA-2022:7583
AlmaLinux:9xorg-x11-server-Xwayland21.1.3-3.el9ALSA-2022:8222
AlmaLinux:8xorg-x11-server-common1.20.11-9.el8ALSA-2022:7583
AlmaLinux:9xorg-x11-server-common1.20.11-11.el9ALSA-2022:8221
AlmaLinux:8xorg-x11-server-devel1.20.11-9.el8ALSA-2022:7583
AlmaLinux:9xorg-x11-server-devel1.20.11-11.el9ALSA-2022:8221
AlmaLinux:8xorg-x11-server-source1.20.11-9.el8ALSA-2022:7583
AlmaLinux:9xorg-x11-server-source1.20.11-11.el9ALSA-2022:8221
Alpine:v3.20xorg-server21.1.4-r0ALPINE-CVE-2022-2320
Alpine:v3.21xorg-server21.1.4-r0ALPINE-CVE-2022-2320
Alpine:v3.22xorg-server21.1.4-r0ALPINE-CVE-2022-2320
Alpine:v3.23xorg-server21.1.4-r0ALPINE-CVE-2022-2320
Alpine:v3.24xorg-server21.1.4-r0ALPINE-CVE-2022-2320
Debian:12xorg-server2:21.1.4-1DEBIAN-CVE-2022-2320
Debian:13xorg-server2:21.1.4-1DEBIAN-CVE-2022-2320
Debian:14xorg-server2:21.1.4-1DEBIAN-CVE-2022-2320
Debian:12xwayland2:22.1.3-1DEBIAN-CVE-2022-2320
Debian:13xwayland2:22.1.3-1DEBIAN-CVE-2022-2320
Debian:14xwayland2:22.1.3-1DEBIAN-CVE-2022-2320
Rocky Linux:8xorg-x11-server0:1.20.11-9.el8RLSA-2022:7583
Rocky Linux:9xorg-x11-server0:1.20.11-11.el9RLSA-2022:8221
Rocky Linux:8xorg-x11-server-Xwayland0:21.1.3-6.el8RLSA-2022:7583
Rocky Linux:9xorg-x11-server-Xwayland0:21.1.3-3.el9RLSA-2022:8222
Rocky Linux:8xorg-x11-xtrans-devel0:1.4.0-4.el8RLSA-2022:7583
Ubuntu:22.04:LTSxorg-server2:21.1.3-2ubuntu2.1USN-5510-1
Ubuntu:22.04:LTSxorg-server2:21.1.3-2ubuntu2.1UBUNTU-CVE-2022-2320
Ubuntu:22.04:LTSxwayland2:22.1.1-1ubuntu0.1USN-5510-1
Ubuntu:22.04:LTSxwayland2:22.1.1-1ubuntu0.1UBUNTU-CVE-2022-2320

Affected products (as reported)

VendorProductVersions
n/a xorg-x11-server xorg-x11-server 21.1

Weakness: CWE-787

References