Vulnerability · Published Dec 14, 2022 · Assigned by redhat
CVE-2022-46341
High 8.8
In plain English
A high-severity out-of-bounds write in xorg-x11-server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)2.7%top 13.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | tigervnc | 1.12.0-15.el8_8 | ALSA-2023:2830 |
| AlmaLinux:9 | tigervnc | 1.12.0-13.el9_2 | ALSA-2023:2257 |
| AlmaLinux:8 | tigervnc-icons | 1.12.0-15.el8_8 | ALSA-2023:2830 |
| AlmaLinux:9 | tigervnc-icons | 1.12.0-13.el9_2 | ALSA-2023:2257 |
| AlmaLinux:8 | tigervnc-license | 1.12.0-15.el8_8 | ALSA-2023:2830 |
| AlmaLinux:9 | tigervnc-license | 1.12.0-13.el9_2 | ALSA-2023:2257 |
| AlmaLinux:8 | tigervnc-selinux | 1.12.0-15.el8_8 | ALSA-2023:2830 |
| AlmaLinux:9 | tigervnc-selinux | 1.12.0-13.el9_2 | ALSA-2023:2257 |
| AlmaLinux:8 | tigervnc-server | 1.12.0-15.el8_8 | ALSA-2023:2830 |
| AlmaLinux:9 | tigervnc-server | 1.12.0-13.el9_2 | ALSA-2023:2257 |
| AlmaLinux:8 | tigervnc-server-minimal | 1.12.0-15.el8_8 | ALSA-2023:2830 |
| AlmaLinux:9 | tigervnc-server-minimal | 1.12.0-13.el9_2 | ALSA-2023:2257 |
| AlmaLinux:8 | tigervnc-server-module | 1.12.0-15.el8_8 | ALSA-2023:2830 |
| AlmaLinux:9 | tigervnc-server-module | 1.12.0-13.el9_2 | ALSA-2023:2257 |
| AlmaLinux:8 | xorg-x11-server-Xdmx | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xdmx | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xephyr | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xephyr | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xnest | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xnest | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xorg | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xorg | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xvfb | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xvfb | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xwayland | 21.1.3-10.el8 | ALSA-2023:2805 |
| AlmaLinux:9 | xorg-x11-server-Xwayland | 21.1.3-7.el9 | ALSA-2023:2249 |
| AlmaLinux:8 | xorg-x11-server-common | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-common | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-devel | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-devel | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-source | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-source | 1.20.11-17.el9 | ALSA-2023:2248 |
| Alpine:v3.20 | xorg-server | 21.1.5-r0 | ALPINE-CVE-2022-46341 |
| Alpine:v3.21 | xorg-server | 21.1.5-r0 | ALPINE-CVE-2022-46341 |
| Alpine:v3.22 | xorg-server | 21.1.5-r0 | ALPINE-CVE-2022-46341 |
| Alpine:v3.23 | xorg-server | 21.1.5-r0 | ALPINE-CVE-2022-46341 |
| Alpine:v3.24 | xorg-server | 21.1.5-r0 | ALPINE-CVE-2022-46341 |
| Alpine:v3.20 | xwayland | 22.1.6-r0 | ALPINE-CVE-2022-46341 |
| Alpine:v3.21 | xwayland | 22.1.6-r0 | ALPINE-CVE-2022-46341 |
| Alpine:v3.22 | xwayland | 22.1.6-r0 | ALPINE-CVE-2022-46341 |
| Alpine:v3.23 | xwayland | 22.1.6-r0 | ALPINE-CVE-2022-46341 |
| Alpine:v3.24 | xwayland | 22.1.6-r0 | ALPINE-CVE-2022-46341 |
| Debian:12 | xorg-server | 2:21.1.5-1 | DEBIAN-CVE-2022-46341 |
| Debian:13 | xorg-server | 2:21.1.5-1 | DEBIAN-CVE-2022-46341 |
| Debian:14 | xorg-server | 2:21.1.5-1 | DEBIAN-CVE-2022-46341 |
| Debian:12 | xwayland | 2:22.1.6-1 | DEBIAN-CVE-2022-46341 |
| Debian:13 | xwayland | 2:22.1.6-1 | DEBIAN-CVE-2022-46341 |
| Debian:14 | xwayland | 2:22.1.6-1 | DEBIAN-CVE-2022-46341 |
| Ubuntu:22.04:LTS | xorg-server | 2:21.1.3-2ubuntu2.5 | USN-5778-1 |
| Ubuntu:22.04:LTS | xorg-server | 2:21.1.3-2ubuntu2.5 | UBUNTU-CVE-2022-46341 |
| Ubuntu:22.04:LTS | xwayland | 2:22.1.1-1ubuntu0.4 | UBUNTU-CVE-2022-46341 |
| Ubuntu:22.04:LTS | xwayland | 2:22.1.1-1ubuntu0.4 | USN-5778-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | xorg-x11-server | xorg-x11-server-1.20.4 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2151756
- https://access.redhat.com/security/cve/CVE-2022-46341
- FEDORA-2022-c3a65f7c65 vendor-advisory
- FEDORA-2022-721a78b7e5 vendor-advisory
- DSA-5304 vendor-advisory
- FEDORA-2022-dd3eb7e0a8 vendor-advisory
- https://security.gentoo.org/glsa/202305-30