PT-2021-3619 · Unknown+6 · Xorg-X11-Server+6
Jan-Niklas Sohn
·
Published
2021-04-13
·
Updated
2024-06-15
·
CVE-2021-3472
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
xorg-x11-server versions prior to 1.20.11
Description
A flaw was found in xorg-x11-server, where an integer underflow can occur in xserver, leading to a local privilege escalation. The highest threat from this issue is to data confidentiality and integrity as well as system availability. The problem is caused by an error in the XInput extension, which can lead to changes in the contents of a memory area outside the allocated buffer when processing ChangeFeedbackControl requests with specially crafted input data.
Recommendations
For versions prior to 1.20.11, update to version 1.20.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the XInput extension until a patch is available. Avoid using the
ChangeFeedbackControl request with specially crafted input data in the affected API endpoint until the issue is resolved.Fix
LPE
Integer Underflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Linuxmint
Red Hat
Suse
Ubuntu
Xorg-X11-Server