Vulnerability · Published Mar 27, 2023 · Assigned by redhat
CVE-2023-0494
High 7.8
In plain English
A high-severity use-after-free in xorg-x11-server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.9%top 40.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | tigervnc | 1.12.0-9.el8_7.1 | ALSA-2023:0662 |
| AlmaLinux:9 | tigervnc | 1.12.0-5.el9_1.1 | ALSA-2023:0622 |
| AlmaLinux:8 | tigervnc-icons | 1.12.0-9.el8_7.1 | ALSA-2023:0662 |
| AlmaLinux:9 | tigervnc-icons | 1.12.0-5.el9_1.1 | ALSA-2023:0622 |
| AlmaLinux:8 | tigervnc-license | 1.12.0-9.el8_7.1 | ALSA-2023:0662 |
| AlmaLinux:9 | tigervnc-license | 1.12.0-5.el9_1.1 | ALSA-2023:0622 |
| AlmaLinux:8 | tigervnc-selinux | 1.12.0-9.el8_7.1 | ALSA-2023:0662 |
| AlmaLinux:9 | tigervnc-selinux | 1.12.0-5.el9_1.1 | ALSA-2023:0622 |
| AlmaLinux:8 | tigervnc-server | 1.12.0-9.el8_7.1 | ALSA-2023:0662 |
| AlmaLinux:9 | tigervnc-server | 1.12.0-5.el9_1.1 | ALSA-2023:0622 |
| AlmaLinux:8 | tigervnc-server-minimal | 1.12.0-9.el8_7.1 | ALSA-2023:0662 |
| AlmaLinux:9 | tigervnc-server-minimal | 1.12.0-5.el9_1.1 | ALSA-2023:0622 |
| AlmaLinux:8 | tigervnc-server-module | 1.12.0-9.el8_7.1 | ALSA-2023:0662 |
| AlmaLinux:9 | tigervnc-server-module | 1.12.0-5.el9_1.1 | ALSA-2023:0622 |
| AlmaLinux:8 | xorg-x11-server-Xdmx | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xdmx | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xephyr | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xephyr | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xnest | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xnest | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xorg | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xorg | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xvfb | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-Xvfb | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-Xwayland | 21.1.3-10.el8 | ALSA-2023:2805 |
| AlmaLinux:9 | xorg-x11-server-Xwayland | 21.1.3-7.el9 | ALSA-2023:2249 |
| AlmaLinux:8 | xorg-x11-server-common | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-common | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-devel | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-devel | 1.20.11-17.el9 | ALSA-2023:2248 |
| AlmaLinux:8 | xorg-x11-server-source | 1.20.11-15.el8 | ALSA-2023:2806 |
| AlmaLinux:9 | xorg-x11-server-source | 1.20.11-17.el9 | ALSA-2023:2248 |
| Alpine:v3.20 | xorg-server | 21.1.7-r0 | ALPINE-CVE-2023-0494 |
| Alpine:v3.21 | xorg-server | 21.1.7-r0 | ALPINE-CVE-2023-0494 |
| Alpine:v3.22 | xorg-server | 21.1.7-r0 | ALPINE-CVE-2023-0494 |
| Alpine:v3.23 | xorg-server | 21.1.7-r0 | ALPINE-CVE-2023-0494 |
| Alpine:v3.24 | xorg-server | 21.1.7-r0 | ALPINE-CVE-2023-0494 |
| Alpine:v3.20 | xwayland | 22.1.8-r0 | ALPINE-CVE-2023-0494 |
| Alpine:v3.21 | xwayland | 22.1.8-r0 | ALPINE-CVE-2023-0494 |
| Alpine:v3.22 | xwayland | 22.1.8-r0 | ALPINE-CVE-2023-0494 |
| Alpine:v3.23 | xwayland | 22.1.8-r0 | ALPINE-CVE-2023-0494 |
| Alpine:v3.24 | xwayland | 22.1.8-r0 | ALPINE-CVE-2023-0494 |
| Debian:12 | xorg-server | 2:21.1.7-1 | DEBIAN-CVE-2023-0494 |
| Debian:13 | xorg-server | 2:21.1.7-1 | DEBIAN-CVE-2023-0494 |
| Debian:14 | xorg-server | 2:21.1.7-1 | DEBIAN-CVE-2023-0494 |
| Debian:12 | xwayland | 2:22.1.8-1 | DEBIAN-CVE-2023-0494 |
| Debian:13 | xwayland | 2:22.1.8-1 | DEBIAN-CVE-2023-0494 |
| Debian:14 | xwayland | 2:22.1.8-1 | DEBIAN-CVE-2023-0494 |
| Rocky Linux:8 | tigervnc | 0:1.12.0-9.el8_7.1 | RLSA-2023:0662 |
| Rocky Linux:9 | tigervnc | 0:1.12.0-5.el9_1.1 | RLSA-2023:0622 |
| Ubuntu:22.04:LTS | xorg-server | 2:21.1.3-2ubuntu2.7 | USN-5846-1 |
| Ubuntu:22.04:LTS | xorg-server | 2:21.1.3-2ubuntu2.7 | UBUNTU-CVE-2023-0494 |
| Ubuntu:22.04:LTS | xwayland | 2:22.1.1-1ubuntu0.5 | USN-5846-1 |
| Ubuntu:22.04:LTS | xwayland | 2:22.1.1-1ubuntu0.5 | UBUNTU-CVE-2023-0494 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | xorg-x11-server | xorg-server 21.1.7 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H