Vulnerability · Published Oct 17, 2022 · Assigned by VulDB
CVE-2022-3551X.org Server xkb.c ProcXkbGetKbdByName memory leak
Low 3.5
In plain English
A low-severity security flaw in Server from X.org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)2.4%top 15.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | xorg-x11-server-Xdmx | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xdmx | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xephyr | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xephyr | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xnest | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xnest | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xorg | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xorg | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xvfb | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xvfb | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xwayland | 21.1.3-10.el8 | ALSA-2023:2805 |
| AlmaLinux:9 | xorg-x11-server-Xwayland | 21.1.3-7.el9 | ALSA-2023:2249 |
| AlmaLinux:8 | xorg-x11-server-common | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-common | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-devel | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-devel | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-source | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-source | 1.20.11-17.el9 | ALSA-2023:2248 |
| Debian:12 | xorg-server | 2:21.1.4-3 | DEBIAN-CVE-2022-3551 |
| Debian:13 | xorg-server | 2:21.1.4-3 | DEBIAN-CVE-2022-3551 |
| Debian:14 | xorg-server | 2:21.1.4-3 | DEBIAN-CVE-2022-3551 |
| Debian:12 | xwayland | 2:22.1.5-1 | DEBIAN-CVE-2022-3551 |
| Debian:13 | xwayland | 2:22.1.5-1 | DEBIAN-CVE-2022-3551 |
| Debian:14 | xwayland | 2:22.1.5-1 | DEBIAN-CVE-2022-3551 |
| Ubuntu:22.04:LTS | xorg-server | 2:21.1.3-2ubuntu2.3 | USN-5740-1 |
| Ubuntu:22.04:LTS | xorg-server | 2:21.1.3-2ubuntu2.3 | UBUNTU-CVE-2022-3551 |
| Ubuntu:22.04:LTS | xwayland | 2:22.1.1-1ubuntu0.3 | UBUNTU-CVE-2022-3551 |
| Ubuntu:22.04:LTS | xwayland | 2:22.1.1-1ubuntu0.3 | USN-5740-1 |
Affected products (as reported)
Weakness: CWE-404 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://cgit.freedesktop.org/xorg/xserver/commit/?id=18f91b950e22c2a342a4fbc55e9ddf7534a707d2
- https://vuldb.com/?id.211052
- [debian-lts-announce] 20221110 [SECURITY] [DLA 3185-1] xorg-server security update mailing-list
- FEDORA-2022-64ad80875c vendor-advisory
- DSA-5278 vendor-advisory
- FEDORA-2022-613e993500 vendor-advisory
- FEDORA-2022-5495b36bed vendor-advisory
- FEDORA-2022-9100b7aafd vendor-advisory
- GLSA-202305-30 vendor-advisory