CVE-2022-46340

14.12.2022, 21:15

A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 82%

Affected Products (NVD)

Vendor	Product	Version
x.org	x_server	1.20.4
debian	debian_linux	11.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

xorg-server

bookworm	2:21.1.7-3+deb12u7 fixed
bookworm (security)	2:21.1.7-3+deb12u8 fixed
bullseye	2:1.20.11-1+deb11u13 fixed
bullseye (security)	2:1.20.11-1+deb11u14 fixed
sid	2:21.1.14-1 fixed
trixie	2:21.1.14-1 fixed

xwayland

bookworm	2:22.1.9-1 fixed
sid	2:24.1.4-1 fixed
trixie	2:24.1.4-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

xorg-server

bionic	Fixed 2:1.19.6-1ubuntu4.13 released
focal	Fixed 2:1.20.13-1ubuntu1~20.04.5 released
jammy	Fixed 2:21.1.3-2ubuntu2.5 released
kinetic	Fixed 2:21.1.4-2ubuntu1.3 released
lunar	Fixed 2:21.1.5-1ubuntu1 released
trusty	Fixed 2:1.15.1-0ubuntu2.11+esm7 released
xenial	Fixed 2:1.18.4-0ubuntu0.12+esm5 released

xorg-server-hwe-16.04

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	dne
xenial	Fixed 2:1.19.6-1ubuntu4.1~16.04.6+esm4 released

xorg-server-hwe-18.04

bionic	Fixed 2:1.20.8-2ubuntu2.2~18.04.9 released
focal	dne
jammy	dne
kinetic	dne
trusty	dne
xenial	dne

xorg-server-lts-utopic

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	ignored
xenial	dne

xorg-server-lts-vivid

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	ignored
xenial	dne

xorg-server-lts-wily

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	ignored
xenial	dne

xorg-server-lts-xenial

bionic	dne
focal	dne
jammy	dne
kinetic	dne
trusty	ignored
xenial	dne

xwayland

bionic	dne
focal	dne
jammy	Fixed 2:22.1.1-1ubuntu0.4 released
kinetic	Fixed 2:22.1.3-2ubuntu0.2 released
lunar	Fixed 2:22.1.6-1 released
trusty	dne
xenial	dne

openSUSE / SLES Releases

openSUSE Product

Release

xorg-x11-server

suse enterprise desktop 15 SP3	1.20.3-150200.22.5.63.1 fixed
suse enterprise desktop 15 SP4	1.20.3-150400.38.19.1 fixed
suse enterprise desktop 15 SP5	21.1.4-150500.5.1 fixed
suse enterprise desktop 15 SP6	21.1.11-150600.3.2 fixed
suse enterprise desktop 15 SP7	21.1.15-150700.3.2 fixed
suse enterprise sap 12 SP5	1.19.6-10.46.1 fixed
suse enterprise sap 15 SP2	1.20.3-150200.22.5.69.1 fixed
suse enterprise sap 15 SP3	1.20.3-150200.22.5.69.1 fixed
suse enterprise sap 15 SP4	1.20.3-150400.38.19.1 fixed
suse enterprise sap 15 SP5	21.1.4-150500.5.1 fixed
suse enterprise sap 15 SP6	21.1.11-150600.3.2 fixed
suse enterprise sap 15 SP7	21.1.15-150700.3.2 fixed
suse enterprise server 12 SP4	1.19.6-4.45.1 fixed
suse enterprise server 12 SP5	1.19.6-10.46.1 fixed
suse enterprise server 15	1.19.6-150000.8.47.1 fixed
suse enterprise server 15 SP1	1.20.3-150100.14.5.39.1 fixed
suse enterprise server 15 SP2	1.20.3-150200.22.5.69.1 fixed
suse enterprise server 15 SP3	1.20.3-150200.22.5.69.1 fixed
suse enterprise server 15 SP4	1.20.3-150400.38.19.1 fixed
suse enterprise server 15 SP5	21.1.4-150500.5.1 fixed
suse enterprise server 15 SP6	21.1.11-150600.3.2 fixed
suse enterprise server 15 SP7	21.1.15-150700.3.2 fixed

xorg-x11-server-Xvfb

suse enterprise desktop 15 SP5	21.1.4-150500.5.1 fixed
suse enterprise desktop 15 SP6	21.1.11-150600.3.2 fixed
suse enterprise desktop 15 SP7	21.1.15-150700.3.2 fixed
suse enterprise sap 15 SP5	21.1.4-150500.5.1 fixed
suse enterprise sap 15 SP6	21.1.11-150600.3.2 fixed
suse enterprise sap 15 SP7	21.1.15-150700.3.2 fixed
suse enterprise server 15 SP5	21.1.4-150500.5.1 fixed
suse enterprise server 15 SP6	21.1.11-150600.3.2 fixed
suse enterprise server 15 SP7	21.1.15-150700.3.2 fixed

xorg-x11-server-extra

suse enterprise desktop 15 SP3	1.20.3-150200.22.5.63.1 fixed
suse enterprise desktop 15 SP4	1.20.3-150400.38.19.1 fixed
suse enterprise desktop 15 SP5	21.1.4-150500.5.1 fixed
suse enterprise desktop 15 SP6	21.1.11-150600.3.2 fixed
suse enterprise desktop 15 SP7	21.1.15-150700.3.2 fixed
suse enterprise sap 12 SP5	1.19.6-10.46.1 fixed
suse enterprise sap 15 SP2	1.20.3-150200.22.5.69.1 fixed
suse enterprise sap 15 SP3	1.20.3-150200.22.5.69.1 fixed
suse enterprise sap 15 SP4	1.20.3-150400.38.19.1 fixed
suse enterprise sap 15 SP5	21.1.4-150500.5.1 fixed
suse enterprise sap 15 SP6	21.1.11-150600.3.2 fixed
suse enterprise sap 15 SP7	21.1.15-150700.3.2 fixed
suse enterprise server 12 SP4	1.19.6-4.45.1 fixed
suse enterprise server 12 SP5	1.19.6-10.46.1 fixed
suse enterprise server 15	1.19.6-150000.8.47.1 fixed
suse enterprise server 15 SP1	1.20.3-150100.14.5.39.1 fixed
suse enterprise server 15 SP2	1.20.3-150200.22.5.69.1 fixed
suse enterprise server 15 SP3	1.20.3-150200.22.5.69.1 fixed
suse enterprise server 15 SP4	1.20.3-150400.38.19.1 fixed
suse enterprise server 15 SP5	21.1.4-150500.5.1 fixed
suse enterprise server 15 SP6	21.1.11-150600.3.2 fixed
suse enterprise server 15 SP7	21.1.15-150700.3.2 fixed

xorg-x11-server-sdk

suse enterprise sap 15 SP2	1.20.3-150200.22.5.69.1 fixed
suse enterprise sap 15 SP3	1.20.3-150200.22.5.69.1 fixed
suse enterprise server 15	1.19.6-150000.8.47.1 fixed
suse enterprise server 15 SP1	1.20.3-150100.14.5.39.1 fixed
suse enterprise server 15 SP2	1.20.3-150200.22.5.69.1 fixed
suse enterprise server 15 SP3	1.20.3-150200.22.5.69.1 fixed
suse enterprise server 15 SP4	1.20.3-150400.38.19.1 fixed

xorg-x11-server-wayland

suse enterprise desktop 15 SP4	1.20.3-150200.22.5.69.1 fixed
suse enterprise sap 15 SP4	1.20.3-150200.22.5.69.1 fixed
suse enterprise server 15 SP4	1.20.3-150200.22.5.69.1 fixed
suse enterprise workstation 15 SP4	1.20.3-150200.22.5.69.1 fixed

xwayland

suse enterprise desktop 15 SP4	21.1.4-150400.3.12.1 fixed
suse enterprise sap 15 SP4	21.1.4-150400.3.12.1 fixed
suse enterprise server 15 SP4	21.1.4-150400.3.12.1 fixed
suse enterprise workstation 15 SP4	21.1.4-150400.3.12.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

tigervnc

RHEL 7	0:1.8.0-23.el7_9 fixed
RHEL 8	0:1.12.0-15.el8_8 fixed
RHEL 8.8 AUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 E4S	0:1.12.0-15.el8_8 fixed
RHEL 8.8 EUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 TUS	0:1.12.0-15.el8_8 fixed
RHEL 9	0:1.12.0-13.el9_2 fixed

tigervnc-icons

RHEL 7	0:1.8.0-23.el7_9 fixed
RHEL 8	0:1.12.0-15.el8_8 fixed
RHEL 8.8 AUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 E4S	0:1.12.0-15.el8_8 fixed
RHEL 8.8 EUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 TUS	0:1.12.0-15.el8_8 fixed
RHEL 9	0:1.12.0-13.el9_2 fixed

tigervnc-license

RHEL 7	0:1.8.0-23.el7_9 fixed
RHEL 8	0:1.12.0-15.el8_8 fixed
RHEL 8.8 AUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 E4S	0:1.12.0-15.el8_8 fixed
RHEL 8.8 EUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 TUS	0:1.12.0-15.el8_8 fixed
RHEL 9	0:1.12.0-13.el9_2 fixed

tigervnc-selinux

RHEL 8	0:1.12.0-15.el8_8 fixed
RHEL 8.8 AUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 E4S	0:1.12.0-15.el8_8 fixed
RHEL 8.8 EUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 TUS	0:1.12.0-15.el8_8 fixed
RHEL 9	0:1.12.0-13.el9_2 fixed

tigervnc-server

RHEL 7	0:1.8.0-23.el7_9 fixed
RHEL 8	0:1.12.0-15.el8_8 fixed
RHEL 8.8 AUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 E4S	0:1.12.0-15.el8_8 fixed
RHEL 8.8 EUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 TUS	0:1.12.0-15.el8_8 fixed
RHEL 9	0:1.12.0-13.el9_2 fixed

tigervnc-server-applet

RHEL 7

0:1.8.0-23.el7_9

fixed

tigervnc-server-minimal

RHEL 7	0:1.8.0-23.el7_9 fixed
RHEL 8	0:1.12.0-15.el8_8 fixed
RHEL 8.8 AUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 E4S	0:1.12.0-15.el8_8 fixed
RHEL 8.8 EUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 TUS	0:1.12.0-15.el8_8 fixed
RHEL 9	0:1.12.0-13.el9_2 fixed

tigervnc-server-module

RHEL 7	0:1.8.0-23.el7_9 fixed
RHEL 8	0:1.12.0-15.el8_8 fixed
RHEL 8.8 AUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 E4S	0:1.12.0-15.el8_8 fixed
RHEL 8.8 EUS	0:1.12.0-15.el8_8 fixed
RHEL 8.8 TUS	0:1.12.0-15.el8_8 fixed
RHEL 9	0:1.12.0-13.el9_2 fixed

xorg-x11-server-Xdmx

RHEL 7	0:1.20.4-21.el7_9 fixed
RHEL 8	0:1.20.11-15.el8 fixed
RHEL 9	0:1.20.11-17.el9 fixed

xorg-x11-server-Xephyr

RHEL 7	0:1.20.4-21.el7_9 fixed
RHEL 8	0:1.20.11-15.el8 fixed
RHEL 9	0:1.20.11-17.el9 fixed

xorg-x11-server-Xnest

RHEL 7	0:1.20.4-21.el7_9 fixed
RHEL 8	0:1.20.11-15.el8 fixed
RHEL 9	0:1.20.11-17.el9 fixed

xorg-x11-server-Xorg

RHEL 7	0:1.20.4-21.el7_9 fixed
RHEL 8	0:1.20.11-15.el8 fixed
RHEL 9	0:1.20.11-17.el9 fixed

xorg-x11-server-Xvfb

RHEL 7	0:1.20.4-21.el7_9 fixed
RHEL 8	0:1.20.11-15.el8 fixed
RHEL 9	0:1.20.11-17.el9 fixed

xorg-x11-server-Xwayland

RHEL 7	0:1.20.4-21.el7_9 fixed
RHEL 9	0:21.1.3-7.el9 fixed

xorg-x11-server-common

RHEL 7	0:1.20.4-21.el7_9 fixed
RHEL 8	0:1.20.11-15.el8 fixed
RHEL 9	0:1.20.11-17.el9 fixed

xorg-x11-server-devel

RHEL 7	0:1.20.4-21.el7_9 fixed
RHEL 8	0:1.20.11-15.el8 fixed
RHEL 9	0:1.20.11-17.el9 fixed

xorg-x11-server-source

RHEL 7	0:1.20.4-21.el7_9 fixed
RHEL 8	0:1.20.11-15.el8 fixed
RHEL 9	0:1.20.11-17.el9 fixed

Amazon Linux Releases

Amazon Package

Release

xorg-x11-server-Xdmx

Amazon Linux 1	0:1.17.4-18.50.amzn1 fixed
Amazon Linux 2	0:1.20.4-22.amzn2 fixed
Amazon Linux 2023	0:1.20.14-12.amzn2023.0.2 fixed

xorg-x11-server-Xdmx-debuginfo

Amazon Linux 2023

0:1.20.14-12.amzn2023.0.2

fixed

xorg-x11-server-Xephyr

Amazon Linux 1	0:1.17.4-18.50.amzn1 fixed
Amazon Linux 2	0:1.20.4-22.amzn2 fixed
Amazon Linux 2023	0:1.20.14-12.amzn2023.0.2 fixed

xorg-x11-server-Xephyr-debuginfo

Amazon Linux 2023

0:1.20.14-12.amzn2023.0.2

fixed

xorg-x11-server-Xnest

Amazon Linux 1	0:1.17.4-18.50.amzn1 fixed
Amazon Linux 2	0:1.20.4-22.amzn2 fixed
Amazon Linux 2023	0:1.20.14-12.amzn2023.0.2 fixed

xorg-x11-server-Xnest-debuginfo

Amazon Linux 2023

0:1.20.14-12.amzn2023.0.2

fixed

xorg-x11-server-Xorg

Amazon Linux 1	0:1.17.4-18.50.amzn1 fixed
Amazon Linux 2	0:1.20.4-22.amzn2 fixed
Amazon Linux 2023	0:1.20.14-12.amzn2023.0.2 fixed

xorg-x11-server-Xorg-debuginfo

Amazon Linux 2023

0:1.20.14-12.amzn2023.0.2

fixed

xorg-x11-server-Xvfb

Amazon Linux 1	0:1.17.4-18.50.amzn1 fixed
Amazon Linux 2	0:1.20.4-22.amzn2 fixed
Amazon Linux 2023	0:1.20.14-12.amzn2023.0.2 fixed

xorg-x11-server-Xvfb-debuginfo

Amazon Linux 2023

0:1.20.14-12.amzn2023.0.2

fixed

xorg-x11-server-Xwayland

Amazon Linux 2

0:1.20.4-22.amzn2

fixed

xorg-x11-server-common

Amazon Linux 1	0:1.17.4-18.50.amzn1 fixed
Amazon Linux 2	0:1.20.4-22.amzn2 fixed
Amazon Linux 2023	0:1.20.14-12.amzn2023.0.2 fixed

xorg-x11-server-debuginfo

Amazon Linux 1	0:1.17.4-18.50.amzn1 fixed
Amazon Linux 2	0:1.20.4-22.amzn2 fixed
Amazon Linux 2023	0:1.20.14-12.amzn2023.0.2 fixed

xorg-x11-server-debugsource

Amazon Linux 2023

0:1.20.14-12.amzn2023.0.2

fixed

xorg-x11-server-devel

Amazon Linux 1	0:1.17.4-18.50.amzn1 fixed
Amazon Linux 2	0:1.20.4-22.amzn2 fixed
Amazon Linux 2023	0:1.20.14-12.amzn2023.0.2 fixed

xorg-x11-server-source

Amazon Linux 1	0:1.17.4-18.50.amzn1 fixed
Amazon Linux 2	0:1.20.4-22.amzn2 fixed
Amazon Linux 2023	0:1.20.14-12.amzn2023.0.2 fixed

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

References

https://access.redhat.com/security/cve/CVE-2022-46340

https://bugzilla.redhat.com/show_bug.cgi?id=2151755

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWTH3SNJ3GKYDSN7I3QDGWYEPSMWU6EP/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/

https://security.gentoo.org/glsa/202305-30

https://www.debian.org/security/2022/dsa-5304

https://access.redhat.com/security/cve/CVE-2022-46340

https://bugzilla.redhat.com/show_bug.cgi?id=2151755

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWTH3SNJ3GKYDSN7I3QDGWYEPSMWU6EP/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/

https://security.gentoo.org/glsa/202305-30

https://www.debian.org/security/2022/dsa-5304