CVE-2022-46340

EUVD-2022-49156

14.12.2022, 21:15

A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	ADP	8.8 HIGH	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 78%

Affected Products (NVD)

Vendor	Product	Version
x.org	x_server	1.20.4
debian	debian_linux	11.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

xorg-server

bookworm	2:21.1.7-3+deb12u7 fixed
bookworm (security)	2:21.1.7-3+deb12u8 fixed
bullseye	2:1.20.11-1+deb11u13 fixed
bullseye (security)	2:1.20.11-1+deb11u14 fixed
sid	2:21.1.14-1 fixed
trixie	2:21.1.14-1 fixed

xwayland

bookworm	2:22.1.9-1 fixed
sid	2:24.1.4-1 fixed
trixie	2:24.1.4-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

xorg-server

bionic	Fixed 2:1.19.6-1ubuntu4.13 released
focal	Fixed 2:1.20.13-1ubuntu1~20.04.5 released
jammy	Fixed 2:21.1.3-2ubuntu2.5 released
kinetic	Fixed 2:21.1.4-2ubuntu1.3 released
lunar	Fixed 2:21.1.5-1ubuntu1 released
trusty	Fixed 2:1.15.1-0ubuntu2.11+esm7 released
xenial	Fixed 2:1.18.4-0ubuntu0.12+esm5 released

xorg-server-hwe-16.04

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	dne
xenial	Fixed 2:1.19.6-1ubuntu4.1~16.04.6+esm4 released

xorg-server-hwe-18.04

bionic	Fixed 2:1.20.8-2ubuntu2.2~18.04.9 released
focal	dne
jammy	dne
kinetic	dne
trusty	dne
xenial	dne

xorg-server-lts-utopic

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	ignored
xenial	dne

xorg-server-lts-vivid

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	ignored
xenial	dne

xorg-server-lts-wily

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	ignored
xenial	dne

xorg-server-lts-xenial

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	ignored
xenial	dne

xwayland

bionic	dne
focal	dne
jammy	Fixed 2:22.1.1-1ubuntu0.4 released
kinetic	Fixed 2:22.1.3-2ubuntu0.2 released
lunar	Fixed 2:22.1.6-1 released
trusty	dne
xenial	dne

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

References

https://access.redhat.com/security/cve/CVE-2022-46340

https://bugzilla.redhat.com/show_bug.cgi?id=2151755

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWTH3SNJ3GKYDSN7I3QDGWYEPSMWU6EP/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/

https://security.gentoo.org/glsa/202305-30

https://www.debian.org/security/2022/dsa-5304